IP leak test

How this test works

Four channels can carry your address to a website, and a tunnel that protects one may ignore another. This page tests each from the same browser session, so the results describe the exact setup you are about to use.

The IPv4 row is filled in immediately. The other three start when the page loads and update as they finish, each with a status of pass, review or fail and a short explanation. The WebRTC candidate table and the DNS resolver table are shown in full underneath, exactly as on the single-purpose pages, so you can read the detail without leaving this one.

The comparison logic is the same engine that drives the anonymity score. A WebRTC public address that differs from the connection IP is a fail. An IPv6 address located in a different country from the IPv4 is a fail. A DNS resolver in a different country from the IPv4 is a review. Each of those also carries 15 points in the score.

How to read your result

The IPv4 row is the reference. Everything else is compared with it.

Three combinations come up again and again:

• IPv4 correct, WebRTC fails, DNS and IPv6 pass. A browser proxy without UDP support. Replace the WebRTC address in the browser or antidetect profile, or move to a full-tunnel VPN.
• IPv4 correct, DNS reviews, the rest pass. A VPN with DNS set outside the client, or a browser encrypted-DNS setting pointing at a resolver in your home country. Fix the resolver and rerun.
• IPv4 correct, IPv6 fails. The provider tunnels IPv4 only and your network has native IPv6. Disable IPv6 on the adapter while connected, or enable IPv6 in the client if it supports it.

If more than one row fails, fix them in the order WebRTC, DNS, IPv6; WebRTC is the most widely checked by websites, DNS the most widely logged, IPv6 the least common of the three.

How to fix it

Each row has a dedicated page with platform-by-platform steps; the short version is here.

1. IPv4 shows your real ISP. The VPN is not connected or the proxy is not applied to this browser. Reconnect, or check that the browser's proxy settings and the profile's proxy are active, then reload.
2. WebRTC exposes another address. Enable WebRTC protection in your VPN extension, set the browser's WebRTC policy to proxied connections only, or set the antidetect profile to replace the address with the proxy's. Steps per browser are on the WebRTC leak test page.
3. DNS resolver in the wrong country. Turn on the VPN client's DNS-through-tunnel option, enable remote DNS for a SOCKS5 proxy, and clear any browser encrypted-DNS setting that points at a resolver in your real country. The DNS leak test page lists the settings for Windows, macOS, iOS, Android and the major browsers.
4. IPv6 address in another country. Enable IPv6 inside the VPN client if it offers it; otherwise disable IPv6 on the active adapter for the duration of the session. The IPv6 test page has the commands and menus.
5. Rerun this page from the same browser profile. All 4 rows are recomputed on every load, and nothing from the previous run is cached.

Limits of this test

• The test covers the browser. Other applications on the device, including mail clients, torrent clients and system services, may use the network differently. A torrent client in particular can reveal your address to every peer in a swarm through a channel this page does not touch.
• A tunnel that drops after the test is not tested. A kill switch in the VPN client is what protects you at that moment; this page only reports the state at the time it ran.
• Country comparisons depend on geolocation data. The country of each address comes from the DB-IP Lite database, refreshed monthly. A VPN exit or a resolver registered in one country but operated in another can produce a mismatch that is not a leak, and vice versa in rare cases.
• The IPv6 and DNS rows depend on our probe server. If either row says it is not available, that part of the test could not run; the IPv4 and WebRTC rows are still valid.
• WebRTC is tested against one STUN server, and an extension that rewrites candidates will make the row pass by design; the test cannot distinguish a rewritten candidate from a real one.
• Passing is not anonymity. The page checks whether your real network shows through on 4 channels. It does not check cookies, accounts, device identifiers or the reputation of the exit address; the IP checker and the anonymity score cover the address side.

What a VPN leak test cannot tell you about a kill switch

A kill switch is a firewall rule inside the VPN client that blocks all traffic when the tunnel is down. It matters because every leak on this page can also occur in the few seconds between a tunnel dropping and reconnecting, when the system falls back to its ordinary routes and resolvers. This test cannot simulate that moment. If you depend on the tunnel, enable the kill switch, then test it yourself: disconnect the VPN manually and confirm that this page fails to load at all rather than loading with your real address. The ipv6 leak and DNS cases are the ones most often exposed in that gap, because the system's own IPv6 route and resolver settings are what it falls back to.

Torrent clients, games and other applications

Browser tests describe browsers. A torrent client announces your address to a tracker and to peers directly, a game client opens its own UDP sessions, and a mail client resolves names and connects on its own schedule. Each of those uses whatever route the operating system gives it, which is the tunnel if the VPN is a full system tunnel and your real connection if you only configured a browser proxy. For anything outside the browser, the honest answer is to use a system-wide VPN with a kill switch, bind the application to the tunnel interface where it supports that, and accept that a web page cannot verify it for you.

The order to run checks before a login

1. Load this page through the exact browser profile you will log in with, and get 4 passing rows.
2. Open the proxy checker to confirm the IPv4 address is on a residential or mobile network and carries no proxy headers.
3. Open the anonymity score to confirm the time zone and language rows agree with the exit, and that no automation signal is present.
4. Reload this page once more to confirm the result is stable, then open the site you care about.

That sequence takes under a minute and catches the four leak channels, the address-level problems and the browser consistency problems that account for most challenged logins from proxies and VPNs.