VPN leak test: check if your VPN is actually working.
A VPN is working when the internet sees the VPN server’s identity instead of yours: its IP address, its network, its location. The check below asks two independent services what they see from your connection right now, in your browser, so you can compare the answer with and without your VPN connected. A full leak check has three parts — public IP, DNS, and WebRTC — and this page covers the first one live and explains exactly how to test the other two.
Published 2026-07-20 by Phantom VPN. It works on any VPN, not just ours, and nothing it finds is sent to us.
What the internet sees right now.
This check runs entirely in your browser. If nothing appears below it, JavaScript is off or the lookup was blocked — no matter: the manual tests further down answer the same question, plus two more this page cannot.
- Public IP address
- —
- Network / ISP
- —
- Estimated location
- —
How to read it: connected to a VPN, all three boxes should describe the server you connected to — its address, the operator’s network, roughly its country — and not your home connection or your internet provider. Disconnect, check again, and watch the answer change back. If it does not change, your traffic is not going through the tunnel.
The lookup asks independent public services — api.ipify.org for the address, and ipapi.co (or ipwho.is if it does not respond) for the network and location — and shows their answer unmodified. Asking reveals your current IP to them, exactly as visiting any website does. Nothing is sent to Phantom VPN. Location is a database guess and is often a city or two off — the IP and network are the signal.
The three ways a VPN "leaks", in plain language.
A leak is not the tunnel being cracked. It is some part of your traffic quietly taking the ordinary route instead of the tunnel. There are three routes worth checking, and each has its own test.
1. IP leak
The blunt one: websites see your real public IP instead of the VPN server’s. It usually means the tunnel is not actually up — the app shows connected but the system route never switched, or the tunnel dropped and nothing noticed.
Test: the check above, connected and disconnected. Two different answers means the tunnel is carrying your traffic.
2. DNS leak
DNS turns names into addresses, and whoever answers your lookups sees the name of every site you visit. A DNS leak is your lookups going to your internet provider’s resolver outside the tunnel, so your browsing destinations stay visible to them even while the traffic itself is encrypted.
Test: a resolver-echo page such as dnsleaktest.com, linked below. Connected, the resolvers listed should belong to the VPN’s DNS, not your provider.
3. WebRTC leak
WebRTC is the browser machinery behind in-page video calls. To build direct connections it discovers your real addresses, and a page can trigger that without showing you anything. It can reveal your real public IP even while the tunnel is working perfectly, because it is a browser behaviour, not a tunnel failure.
Test: a WebRTC test page, linked below. The fix lives in the browser: disable or restrict WebRTC there.
The manual tests, for what a page like this cannot see.
DNS and WebRTC checks need infrastructure a static page does not have, so rather than fake them we point you at the established testers. Run them with the VPN connected, and once more disconnected so you know what your baseline looks like.
DNS leak test
Run the extended test with your VPN connected. The servers listed should belong to your VPN’s resolver, not to your home internet provider. With Phantom VPN connected you should see Cloudflare, because the tunnel pushes 1.1.1.1 and 1.0.0.1.
Open dnsleaktest.comWebRTC leak test
Shows every IP address your browser’s WebRTC machinery is willing to reveal. With a VPN connected, your real public IP should not appear anywhere on that page.
Open browserleaks.com/webrtcEverything at once
IP, DNS and WebRTC on one page. A good second opinion: if two independent testers agree, trust the result over any single one, including ours.
Open ipleak.netThese are independent sites we do not run and are not affiliated with. They are linked because they are the standard tools for the job, and because a leak test you run on a VPN maker’s own page should always get a second opinion from someone who is not selling you anything.
What these tests show on Phantom VPN, honestly.
IP: the node’s, directly
Connected, the check above shows the IP of the independent Sentinel node you connected to, because the WireGuard tunnel runs straight from your device to that node. The app shows you the assigned IP on the main screen, so you can match the two.
DNS: Cloudflare, inside the tunnel
The tunnel pushes 1.1.1.1 and 1.0.0.1, so a DNS leak test should list Cloudflare, not your internet provider. We do not market this as "DNS leak protection" — it is tunnel configuration, and your queries are answered by Cloudflare, a third party, not by the decentralized network.
WebRTC: your browser’s business
No VPN app fixes WebRTC by itself, ours included. Full-tunnel routing sends WebRTC traffic through the tunnel like everything else, but the reliable fix for the discovery behaviour is in the browser. Test it, then adjust the browser if you do not like what it reveals.
No kill switch, said plainly
Phantom VPN has no kill switch. If the tunnel drops, traffic uses your normal connection until it reconnects — on iPhone and iPad, auto-reconnect can bring it back on a network change, off by default. Re-running this check after switching networks is a habit worth having with any VPN.
Leak-test questions, answered
How do I check if my VPN is actually working?
Look up your public IP address twice: once with the VPN disconnected, once connected. If the VPN is working, the two results differ — connected, you should see the VPN server’s IP address, network and country instead of your own. The test on this page does that lookup in your browser. For a complete picture, also run a DNS leak test and a WebRTC leak test, because your browser can reveal your address through those two side doors even while the main tunnel is fine.
What is a DNS leak?
DNS is the lookup that turns a name like example.com into an IP address. A DNS leak is when those lookups travel outside the VPN tunnel to your internet provider’s resolver, which hands your provider a list of every site you visit even though the traffic itself is encrypted. You test for it by running a DNS leak test while connected: the resolvers shown should belong to the VPN’s DNS, not to your provider.
What is a WebRTC leak?
WebRTC is the browser technology behind in-browser video calls. To connect two people directly it discovers your real IP addresses, and a website can invoke that machinery without showing you anything. If it reveals your real public IP while your VPN is connected, that is a WebRTC leak. It is a browser behaviour, not a tunnel failure: test it at a WebRTC test page, and fix it in the browser, by disabling WebRTC or restricting it with browser settings or an extension.
Does Phantom VPN have DNS leak protection?
Phantom VPN does not ship a feature named DNS leak protection. What it does is push Cloudflare resolvers, 1.1.1.1 and 1.0.0.1, into the tunnel configuration, and route every app through the tunnel with full-tunnel AllowedIPs. While the tunnel is up, DNS queries travel inside it to Cloudflare rather than to your internet provider. We would rather describe the mechanism than claim a feature label, and you can verify the result yourself at dnsleaktest.com.
Does Phantom VPN have a kill switch?
No. If the tunnel drops, your traffic uses your normal connection until the tunnel is re-established. On iPhone and iPad you can turn on auto-reconnect, which uses the system’s on-demand rules to bring the tunnel back when your network changes; it is off by default. If a kill switch is a hard requirement for you, a provider that ships one is the better fit today, and we would rather say that than imply protection we have not built.
The location shown for my VPN server is wrong. Is that a leak?
Usually not. IP geolocation is an educated guess maintained by commercial databases, and they are frequently a city or even a country off, for VPN servers especially. The signal that matters is whose network the IP belongs to. If the IP and network shown are the VPN node’s and not your home provider’s, the tunnel is doing its job, wherever a database chooses to draw the pin.
Why does this test need to contact third-party services?
Because "what IP does the internet see" is a question only someone outside your connection can answer. This page asks independent public services — api.ipify.org for the address, and ipapi.co or ipwho.is for the network and location — what they see, in your browser, and shows you their answer. Phantom VPN never receives the result. Note the obvious: asking the question reveals your current IP to those services, exactly as visiting any website does.
A VPN you can test is worth more than one you trust.
Phantom VPN shows you the exact IP you were assigned the moment you connect, so this page can hold it to account. Free to start: watch a short ad, get 60 minutes.