WebRTC leak test
WebRTC can hand a website your real IP address even while your VPN is connected, with no permission prompt and nothing shown in the interface. This page runs the same request any website would, and compares what it gets back against the address your connection actually presents.
Gathering ICE candidates…
Opening a peer connection and collecting the addresses your browser offers, the same way a website would.
Address your connection presents
Addresses WebRTC exposed
The test runs entirely in your browser. Reaching a public STUN server (Google and Cloudflare) is unavoidable — that is precisely the request a leaking page makes, so the test would prove nothing without it. No result is transmitted or stored.
Why this leak exists at all
1. The browser needs a route
A video call goes directly between two people rather than through a server, so the browser has to advertise every way it might be reachable: addresses on your local network, and the public one the internet sees.
2. A STUN server holds the mirror
To learn its public address the browser asks a STUN server on the open internet “what address did this arrive from?”. The answer becomes a server-reflexive candidate — and if that request went outside your tunnel, the answer is your real address.
3. Any page can read it
The candidate list is handed to the JavaScript that started the connection. No prompt, no indicator, no camera light. A page can collect it in the background while it looks like it is doing nothing at all.
Why a full-tunnel VPN closes it
The leak is not a bug in WebRTC — it is doing exactly what it was designed to do. It becomes a leak when your VPN routes only some traffic, so the STUN request takes a different path from your browsing and sees a different address. A VPN configured at the operating-system level with AllowedIPs 0.0.0.0/0, ::/0has no such second path: every packet from the device enters the tunnel regardless of which application produced it. That is how Phantom VPN is configured, and this test is how you confirm it rather than trusting the claim.
WebRTC leak questions, answered
What is a WebRTC leak?
WebRTC is the browser feature behind video calls in a tab. To connect two people directly it has to work out how each of them can be reached, so it collects "ICE candidates" — a list of your addresses, including the public one a STUN server on the internet observed. Any page can start that process with a few lines of JavaScript and read the result, with no permission prompt. If your VPN does not carry that traffic, the address collected is your real one, and the site learns it even though every ordinary request is going through the tunnel.
How do I know if I have a WebRTC leak?
Run the test above with your VPN connected. It reports the addresses WebRTC exposed and compares them with the address our server sees. If they match, there is no leak: WebRTC is inside the tunnel. If WebRTC exposes a different public address, that is the leak, and the address shown is the one your VPN is supposed to be hiding.
What does a .local address mean in the results?
It means your browser is protecting you. Chrome, Edge, Firefox and Safari now replace real local network addresses with a randomised mDNS name ending in .local, so pages learn a meaningless token instead of your LAN address. Seeing .local names is the good outcome and needs no action.
How do I fix a WebRTC leak?
The reliable fix is a VPN that routes all traffic — including WebRTC — through the tunnel, which is what a full-tunnel configuration does. Beyond that: in Firefox, set media.peerconnection.enabled to false in about:config. Chrome has no built-in switch, so it needs an extension such as uBlock Origin, which has a "Prevent WebRTC from leaking local IP addresses" setting. Disabling WebRTC entirely will break video calling in the browser, which is the trade-off.
Does a WebRTC leak reveal my real IP even with a VPN on?
That is exactly what it does, and why it matters more than most leak types. Your browsing goes through the VPN, so a normal IP check looks clean, while WebRTC hands out the real address separately. That is the whole danger: the tests that look fine are testing the wrong thing.
Does Phantom VPN leak WebRTC?
Phantom VPN uses a full-tunnel WireGuard configuration — AllowedIPs is 0.0.0.0/0 and ::/0 — so every packet the device sends, including WebRTC, is routed into the tunnel at the operating-system level rather than per-application. There is nothing outside the tunnel for WebRTC to escape through. Run this test with it connected and verify that yourself rather than taking our word for it.
The rest of the check
No single test proves a VPN is working. Each one below closes a different hole.