WebRTC leak test

Gather ICE candidates in this browser and classify their type and address scope. The page displays redacted addresses, keeps them in memory only and reports a warning only when it actually observes an unmasked private/local candidate.

Browser ICE candidate check

This test uses Cloudflare public STUN after you press Run so the browser can request a server-reflexive candidate. That STUN service can see your source address. PublicVPNList does not store or send candidate addresses to analytics.

—result

—host candidates

—srflx candidates

—relay candidates

—IPv4 candidates

—IPv6 candidates

—public IP (redacted)

Ready. Connect or disconnect the VPN and run again to compare.

How to interpret the candidates

host: an interface candidate; modern browsers often replace local addresses with an mDNS .local name.
srflx: a server-reflexive address learned through STUN. It may show the VPN exit or the underlying route.
relay: a TURN relay address. This tool does not configure a TURN account, so relay candidates are normally absent.

Pass means no unmasked private address was observed. Warning identifies an actual private candidate. Inconclusive means privacy masking, a blocker or browser policy exposed no usable candidates.

Privacy limits

WebRTC is only one browser path. A clean result does not test DNS, system applications, cookies or operator behavior. Repeat the check before and after VPN connection, and compare it with the public IP and DNS resolver tests.

VPN leak dashboard Public IP check

Frequently asked questions

What does mDNS masking mean?: The browser replaces a local IP with a temporary .local hostname so page JavaScript cannot read the raw private address.
Why are there no relay candidates?: Relay candidates require a configured TURN service and credentials. This test intentionally does not provide them.
Does a WebRTC pass prove that the VPN is private?: No. It only means the browser did not expose an unmasked private candidate during this run.