IPv6 leak test
If your VPN only routes IPv4 and your connection also speaks IPv6, then every IPv6-capable site — Google, YouTube, Facebook, anything behind Cloudflare — sees your real address while your IP check reports a clean result. This test looks at both protocols separately, which is the only way to see it.
Testing both protocols…
Asking one IPv4-only endpoint and one dual-stack endpoint what address each sees.
The two protocol probes use ipify’s IPv4-only and dual-stack endpoints, because the test needs a host reachable over each protocol independently and our own API is IPv4-only. Those requests reveal to ipify exactly what any website you load already learns. The network and location lookup is done by our own server.
Why this leak is so easy to miss
The internet runs two networks
IPv4 and IPv6 are separate address systems running side by side over the same wires. Your device usually has an address on both and picks whichever the site it is loading supports, preferring IPv6 when it works.
Older VPNs only carry one
A tunnel configured for 0.0.0.0/0 captures all IPv4 and says nothing about IPv6, so IPv6 packets never enter it. They leave over your ordinary connection with your ordinary address attached.
The usual checks miss it
Most IP checkers answer only over IPv4, so they measure the half that works and report success. The leak is on a path they never touch — which is why it can run for years unnoticed.
What a correct configuration looks like
In WireGuard the relevant line is AllowedIPs, which decides what enters the tunnel. 0.0.0.0/0 alone means IPv4 only, and any IPv6 on the device leaks. 0.0.0.0/0, ::/0 means both, and nothing has a route around it. That second form is what Phantom VPN ships. You do not have to trust that: the test above measures the outcome rather than reading the configuration.
IPv6 leak questions, answered
What is an IPv6 leak?
Many VPNs were built when IPv4 was all that mattered, and route only IPv4 into the tunnel. If your connection also has IPv6 — most home and mobile connections now do — then IPv6 traffic simply ignores the VPN and goes out over your normal connection carrying your real address. Any site reachable over IPv6, which includes Google, YouTube, Facebook and Cloudflare-hosted sites, sees straight through the VPN.
Why does an ordinary IP check not catch this?
Because most "what is my IP" pages are reachable only over IPv4, so the browser uses IPv4 to load them, and IPv4 is the part your VPN is handling correctly. The check reports the VPN address and looks perfect. The leak is on the path it never tested. That is what makes this leak type worth its own page.
How do I fix an IPv6 leak?
Best: use a VPN that routes IPv6 into the tunnel as well as IPv4 — in WireGuard terms, AllowedIPs must include ::/0 and not just 0.0.0.0/0. Second best: a VPN that deliberately blocks IPv6 while connected, so the traffic fails instead of leaking. As a last resort you can disable IPv6 in your operating system, but that degrades connectivity to IPv6-only services and is a workaround for a VPN that should be handling it.
Should I just disable IPv6?
It works, and it is a blunt instrument. IPv6 exists because IPv4 addresses ran out, and turning it off pushes you onto carrier-grade NAT, which is often slower and shares one address among many customers. Disabling IPv6 to fix a VPN is treating the symptom. A VPN that cannot route the protocol half the internet now runs on is the actual problem.
Does Phantom VPN leak IPv6?
No. Phantom VPN uses a full-tunnel WireGuard configuration with AllowedIPs set to 0.0.0.0/0 and ::/0, so IPv6 is routed into the tunnel alongside IPv4 rather than being left to find its own way out. Connect it and run this test — the point of this page is that you should not have to take the claim on trust.
The test says I have no IPv6. Is that bad?
Not at all, and it means you cannot have an IPv6 leak — there is no IPv6 traffic to leak. Plenty of connections are still IPv4-only, particularly on some ISPs and corporate networks. It also means that if you later change networks, this is worth re-running, because the answer depends on the connection rather than the device.
The rest of the check
No single test proves a VPN is working. Each one below closes a different hole.