Home · Tools · WebRTC leak test
WebRTC
WebRTC leak test
WebRTC leak test: press Scan and read the candidates this browser offers. Host is this machine, reflexive is what a STUN server saw, relay is a relay address, and .local is an mDNS mask, not your LAN IP. A different public address does not prove a VPN failed. The STUN lookup runs only after you scan.
- Candidates stay in the tab
- mDNS is not called a LAN leak
- STUN is disclosed
- No VPN ranking
What does this WebRTC leak test show?
This WebRTC leak test lists host, reflexive, relay, and mDNS candidates after you press Scan. A .local name is an mDNS mask, not your LAN IP. A different public address does not prove a VPN failed. The STUN lookup runs only after you scan. Candidate lines are not uploaded.
RFC 8828: WebRTC IP Address Handling Requirements
Last updated
Scan browser
Nothing is read until you start the scan. This page load does not draw a canvas, open WebRTC, or ask the server for an address.
How to test for a WebRTC leak
Press Scan. The page opens a short peer connection, lists the addresses this browser offers, then closes it. This page load does not start the test.
A host candidate is an address on this machine. A reflexive candidate is a public address a STUN server observed. A relay candidate is a relay address. A name ending in .local is an mDNS mask, not your LAN IP.
If that public address differs from the address this site sees, the path may include a VPN, a proxy, or another interface. The difference does not prove a VPN failed. A DNS leak test is not part of this page.
What it tests
The page opens a short RTCPeerConnection, gathers ICE candidates, then closes it.
A STUN server is used so the browser can learn a server-reflexive address. That request goes to the STUN host, not into a CreatorPrivacyKit profile. Candidate lines are not uploaded. The separate site-seen IP comparison is off by default.
Why it matters
A host candidate with a 192.168.x or similar address shows a private network address to the page.
A server-reflexive address is the address a STUN server saw. If it differs from the address this website sees, a VPN, proxy, or another interface may be in the path. The test does not decide which one is your ISP address.
How the test works
Names ending in .local are mDNS masks used by current browsers so the page does not learn the raw LAN address. They are marked protected, not leaked.
A timeout is indeterminate, not protected. If ICE gathering finishes with no candidates, the report says only that no candidates were observed.
What the result means
A raw private host address is exposure. A public server-reflexive address is an observation, not proof that a VPN was bypassed. Enable the optional site-seen IP comparison to see whether the two public addresses match.
Relay-only means the browser offered a relay address rather than your host address. It is not a certificate that every app on the computer is covered.
How to reduce exposure
Possible mitigations include the browser’s WebRTC protection, a VPN’s WebRTC handling, or disabling WebRTC where you can accept the breakage.
None of those is guaranteed by a brand name. Scan again after you change the setting.
What host, srflx, prflx, and relay mean
The W3C WebRTC Recommendation (13 March 2025) names four RTCIceCandidateType values: host, srflx, prflx, and relay. RFC 8839 uses the same four tokens after typ on an SDP candidate line.
RFC 8445 defines a host candidate as a transport address on a local interface, including a VPN or other tunnel. A server-reflexive candidate is the translated address on the public side of a NAT, learned from STUN or TURN. A relayed candidate is an address allocated on a TURN server. If only STUN servers are used, only server-reflexive candidates come from them. A peer-reflexive candidate is learned during a connectivity check. This page does not complete a call with another peer, so a peer-reflexive address is uncommon. The summary groups prflx with srflx.
What Scan browser does on this page
Press Scan browser. Opening the page does not start the test. The idle line says this page load does not open WebRTC.
The scan creates one RTCPeerConnection, opens a data channel named cpk, calls createOffer and setLocalDescription, and collects ICE candidates. The only STUN server in this build is stun:stun.cloudflare.com:3478. Gathering stops when the browser says it is complete, or after 4 seconds, and the connection is closed. Candidate lines stay in the tab. They are not uploaded.
The checkbox Include site-seen public IP stays off until you turn it on. When it is on, the scan makes one same-origin request so this site can show the IP address on that request. That request is separate from STUN. The STUN lookup does leave this device: it is a request to the STUN host, not an upload of the candidate list.
How to read the lines this page prints
The WebRTC card prints one of the sentences below. The heading above the cards is a separate score. This page’s scan does not read canvas, WebGL, audio, or fonts, so that heading follows the WebRTC card only. The words in bold are the English strings in this build, from the value table in the page script.
- Private address in a host candidate. Card status Exposed. The heading becomes High exposure. Under Advanced details the name is
private-ip. - Public WebRTC address observed; site-seen HTTP address not checked. A public address arrived and Include site-seen public IP is still off. Card status Exposed. The heading becomes Moderate exposure. The name is
public-srflx-uncompared. A public host candidate and a public reflexive candidate both use this sentence. The collector’s earlier namespublic-srflxandpublic-hostare rewritten to it before the report is shown. Advanced details still hascounts.hostandcounts.srflx. - Same public address observed via WebRTC and HTTP. The checkbox is on, and every distinct public candidate matches the address on that same-origin request. Card status Exposed. The heading stays Low exposure, because a match is not scored as a mismatch. The name is
public-srflx-same-http. Low exposure is not a privacy certificate. The score note says missing APIs are unavailable, not safe. - Different public address observed via WebRTC. The checkbox is on, and at least one public candidate differs from the site-seen address. A mix of IPv4 and IPv6 counts as different. Card status Exposed. The heading becomes Moderate exposure. The name is
public-srflx-different-http. The difference does not, by itself, prove a VPN failed. - Relay candidates only. Card status Limited. Heading Low exposure. Name
relay-only. - Host candidates use mDNS (.local). Card status Protected. Heading Low exposure. Name
mdns. Protected on this card is not a claim about other applications. - Candidates were limited. Something arrived that is not a private host, a public address, a relay-only set, or only mDNS names. Card status Limited. Name
limited-candidates. - No ICE candidates. Nothing arrived. Card status Limited. Name
no-candidates. That is not a certificate that WebRTC is off in every application. - The probe did not finish. The 4-second cap fired before any candidate arrived. Card status Unavailable. That is indeterminate, not Protected. If some candidates arrived before the cap, the page classifies those and does not use this sentence.
- Browser blocked this probe. The peer connection could not be created, and no candidate arrived. Card status Browser-blocked.
- Not exposed by this browser. This tab has no
RTCPeerConnection. Card status Unavailable. - Could not determine. Gathering failed before any candidate arrived. Card status Unavailable.
A separate IPv6 card can say IPv6 seen via WebRTC (status Exposed) when a public IPv6 candidate arrived, Only a local IPv6 address (status Limited) for a private IPv6 address, or No IPv6 candidate was observed in this WebRTC run. A name ending in .local is an mDNS mask. This page does not turn it back into a LAN address. The WebRTC Recommendation says that when iceTransportPolicy is relay, candidates that need external resolution, including mDNS candidates, must be prohibited. This scan does not set that policy. It records what the browser returned.
What RFC 8828 says this scan does not control
RFC 8828 (January 2021) describes three kinds of extra information WebRTC can reveal beyond the single public address of an ordinary page request: other public addresses on a multihomed machine or a split-tunnel VPN, private addresses (often RFC 1918) behind a NAT, and the public address seen by STUN when a configured classical proxy is bypassed because direct Internet access is allowed.
The same RFC describes four gathering modes. Mode 1 enumerates all interfaces and must not be used without user consent. Without that consent, mode 2 should be used: the default route, plus the private addresses on the chosen interface. Mode 3 keeps the default route and must not provide those private addresses. Mode 4 also forces media through the HTTP proxy. This page does not choose a mode. RFC 8828 says a missing host candidate can mean mode 3 or 4 is in use. That is a diagnostic, not a VPN grade.
This scan does not read DNS resolvers, microphone or camera permission, or other applications. The 4-second cap can miss a candidate that arrives later. A public address that differs from the optional site-seen IP does not, by itself, prove a VPN failed.
How this page compares with BrowserLeaks
As read on 21 October 2026, BrowserLeaks’ WebRTC page shows a remote IP, whether RTCPeerConnection and RTCDataChannel exist, a local IP and a public IP, an SDP log, and media-device permission state. Its disable notes tell Firefox users to set media.peerconnection.enabled to false in about:config, and point Chrome users to Google’s WebRTC Network Limiter extension. This site did not re-test that page and does not know which STUN host it uses.
This page gathers candidates from one data channel and one STUN server, classifies host, srflx, prflx, relay, and .local names, and does not list microphones or cameras. It does not rank VPN brands. The shorter definition is Can WebRTC show an IP address?
One headless Chrome run, 26 October 2026
On 26 October 2026 a headless Google Chrome 154.0.8037.92 opened RTCPeerConnection with iceServers stun:stun.cloudflare.com:3478, created a data channel named cpk, and stopped gathering at 4 seconds or when ICE completed. That STUN URL, channel name, and 4 second cap match collectWebRtcSignals in src/browser-privacy/webrtc.js. This was not a click of the Scan button on the published page. Chrome was launched with --no-sandbox and --disable-dev-shm-usage.
Gathering ended as timeout-4000 after 4002 ms. Two UDP candidates had already arrived: one host candidate whose address was an mDNS .local name, not a raw private IP, and one server-reflexive candidate that was a public IPv4 address. There was no prflx, relay, or IPv6 candidate. The address strings are omitted. The site-seen HTTP address was not requested, so this run is the public-srflx case in which the HTTP address was not compared. It is not a verdict about a VPN.
A second launch added --force-webrtc-ip-handling-policy=disable_non_proxied_udp. Gathering was again timeout-4000, after 4001 ms, with the same counts. Matching counts do not prove the flag was applied inside this headless launch.
The static BrowserLeaks WebRTC page, read on 26 October 2026 without executing its script, still shows headings for a remote IP, RTCPeerConnection and RTCDataChannel support, a local WebRTC IP, a public WebRTC IP, a session description, and media devices. Its disable notes still point Firefox to media.peerconnection.enabled set false in about:config, and Chrome to the WebRTC Network Limiter extension. This site did not run that test and still does not know which STUN host that page uses. The 21 October paragraph above stands. This run did not list microphones or cameras, and it did not use a VPN.
Questions
How do I test for a WebRTC leak?
Press Scan and read the candidate list. Host means an address on this machine. Reflexive means a public address a STUN server observed. Relay means a relay address. A .local name is mDNS, not your LAN IP. A public address that differs from the address this site sees does not, by itself, prove a VPN failed. The optional site-seen IP check stays off until you turn it on. DNS resolvers are not tested here.
Is xxxx.local my real local IP?
No. It is an mDNS name. The page cannot turn it back into the LAN address.
Does a different public address mean my VPN failed?
No. A server-reflexive address that differs from the address this site sees can come from a VPN, a proxy, or another interface. The test does not decide which. An mDNS name ending in .local is not your LAN IP.
Does this include a DNS leak test?
No. DNS resolvers are not guessed here.
Which STUN server does this WebRTC leak test use?
stun:stun.cloudflare.com:3478. The lookup runs only after you press Scan browser, stops at 4 seconds or when gathering completes, and the peer connection is closed. Candidate lines are not uploaded.
What do the WebRTC result lines mean?
With Include site-seen public IP off, a public address prints “Public WebRTC address observed; site-seen HTTP address not checked,” and the heading says Moderate exposure. Turn the checkbox on and the line becomes “Same public address observed via WebRTC and HTTP” (the heading stays Low exposure) or “Different public address observed via WebRTC” (Moderate exposure). A private host prints “Private address in a host candidate” and the heading says High exposure. “The probe did not finish” means the 4-second cap fired before any candidate arrived. That card is Unavailable, not Protected. Low exposure is not a privacy certificate.
Does this page enforce an RFC 8828 mode?
No. RFC 8828 describes modes 1 through 4 for how a browser gathers addresses. This scan reports the candidates the browser returned. It does not switch those modes, and it does not test DNS resolvers.