Free tool · Runs in your browser

WebRTC leak test

Checks whether WebRTC reveals an IP address other than the one your connection uses, whether your local address is exposed, and whether your time zone and languages fit where your IP is.

Asks Google's public STUN server (stun.l.google.com:19302) which address your browser's WebRTC traffic comes from, and compares it with the address this page came from. Nothing is stored.

How the test works

Your browser starts a WebRTC connection to Google's public STUN server, exactly as a video call would, and reports the addresses it gathers: host candidates (your device's own addresses, normally hidden behind .local names) and server-reflexive candidates (your public address, as the STUN server saw it). Our server reports the address this page arrived from. If WebRTC's public address is a different one, WebRTC traffic is taking a different route from your web traffic.

The time zone rows compare the location Vercel's network derives from your IP with the clock your browser reports; they are the same checks the browser fingerprint test runs.

How to stop a WebRTC leak

Chrome and Edge, managed: the WebRtcIPHandling policy set to disable_non_proxied_udp makes WebRTC use the proxy or nothing.
Chrome and Chromium, launched by a script: the same setting as a switch, --force-webrtc-ip-handling-policy=disable_non_proxied_udp (source). With Playwright or Puppeteer, pass it in the launch arguments.
Brave: Settings, Privacy and security, WebRTC IP handling policy.
Firefox: media.peerconnection.enabled set to false in about:config turns WebRTC off entirely.
A VPN that carries UDP, and not only web traffic, removes the leak for every application on the machine.

Run the test again afterwards: the public address WebRTC reports should be the one websites see, or there should be none.

FAQ

What is a WebRTC leak?

WebRTC is how browsers make voice and video calls. To connect two people it asks a public STUN server which address its traffic comes from, and any web page can start that process and read the answer. Media travels over UDP, which many proxies and some VPN setups do not carry, so the answer can be your real address even when the page itself came through the proxy.

Does a VPN stop WebRTC leaks?

A VPN that routes all traffic, UDP included, through the tunnel leaves nothing to leak: STUN sees the VPN's address, the same one websites see. Leaks happen with proxies that carry only HTTP, browser-extension "VPNs" (which are proxies), and split-tunnel setups. The test above shows which case you are in.

What does "hidden (mDNS)" mean for my local address?

Current browsers no longer show a page your local network address (such as 192.168.1.23) by default. They replace it with a random name ending in .local, which only works on your own network. A literal local address in the results means that protection is off.

Is disabling WebRTC a good idea?

It stops the leak but is visible in its own right: every mainstream browser ships WebRTC, so a page that finds RTCPeerConnection missing, or no candidates at all, learns something too. Restricting WebRTC to the proxy, as below, keeps it working and removes the leak.

Why does my time zone matter?

A proxy or VPN moves your IP address but not your computer's clock. A site can compare the time zone your IP belongs to with the one your browser reports, at the same instant; hours apart is what a proxy typically looks like. Travellers and people who keep their clock in UTC see it too, so sites usually weigh it together with other signals.

Is anything stored?

No. Google's STUN server sees your address, as with any WebRTC call; our server reports back the address and location it saw and keeps nothing.

Clearcote puts this into practice

An open-source Chromium with fingerprint control compiled into the engine. A drop-in for Playwright & Puppeteer.

Get it free Read the docs

Free for one browser with GitHub. No card.