Don't like ads? Go Ad-Free Today 

WebRTC IP Leak Detector

DeveloperNetworkingSecurity

ADVERTISEMENT · REMOVE?

INPUT

OUTPUT

Client Side

Property	Value
Local IPv4
Local IPv6
Public IPv4
Public IPv6
mDNS Obfuscated
Candidates Seen

ICE Candidates

Raw ICE Candidates

ADVERTISEMENT · REMOVE?

Guide

WebRTC IP Leak Detector

WebRTC is a built-in browser API that powers voice and video calls without plugins. To connect two peers directly, it uses the ICE framework to gather candidate IP addresses — and that list includes the machine’s local LAN IP plus any public address a STUN server can see. When users run behind a VPN or proxy, those candidates can expose a real IP that was supposed to be hidden. This detector runs the same discovery flow entirely in your browser, parses every ICE candidate, and flags whether a leak is present.

How to Use

Pick a STUN server — Google, Cloudflare, or Twilio all work as public reference points.
Toggle IPv6 on or off depending on whether your network runs dual-stack.
Click Check for Leaks and wait a few seconds for ICE gathering to complete.
Review the summary table for local, public, and mDNS-obfuscated addresses.
Inspect the raw ICE candidate list to see exactly what the browser exposed to JavaScript.

Features

Real WebRTC probe – Uses RTCPeerConnection and live STUN servers, not a simulated lookup.
Local and public IP detection – Separates host candidates from server-reflexive (srflx) and relay candidates.
IPv4 and IPv6 support – Classifies both address families and filters out RFC1918/link-local noise.
mDNS awareness – Detects when Chrome or Firefox has replaced the raw local IP with a .local hostname.
Leak verdict – Plain-English summary telling you whether a VPN-bypassing leak was found.
Raw candidate export – Copy or download the full ICE candidate list for further analysis.
Multiple STUN providers – Compare results against Google, Cloudflare, or Twilio to cross-check.
100% client-side – No candidates, IPs, or telemetry are ever sent to our servers.

 FAQ

What is a WebRTC IP leak?

A WebRTC IP leak is when a browser's RTCPeerConnection API reveals an IP address — typically the real local or public IP — that a VPN or proxy was supposed to hide. Because WebRTC bypasses the normal HTTP stack to gather peer-to-peer candidates, routing the browser through a VPN does not automatically route the ICE discovery through it. If both a public IP and an unmasked local IP are exposed to JavaScript, a script on any website can fingerprint the real network behind the tunnel.
What are ICE candidates and STUN servers?

ICE (Interactive Connectivity Establishment) is the negotiation framework WebRTC uses to find a viable path between two peers. Each ICE candidate describes one possible address the peer could be reached at, including a type: host (local interface), srflx (server-reflexive, discovered via STUN), or relay (via a TURN server). A STUN (Session Traversal Utilities for NAT) server is a lightweight public service that reports back the public IP and port it saw a connection arrive from — that is how the browser learns its own external address when sitting behind NAT.
How does mDNS obfuscation protect local IPs?

Modern Chrome and Firefox builds replace raw local IPv4 addresses in host candidates with a randomized hostname ending in .local, such as a1b2c3d4-5678-90ab-cdef-1234567890ab.local. These mDNS hostnames are only resolvable on the local network segment during an actual peer negotiation — they are opaque to JavaScript and to third-party STUN servers. That means a script can no longer trivially read the user's 192.168.x.y or 10.x.y.z LAN address from an ICE candidate.
Is exposing the public IP always considered a leak?

Not inherently. The public IP is already visible to any HTTP server the browser contacts, so a STUN-discovered srflx candidate does not reveal anything new in a normal browsing context. The problem is privacy-specific: if the user is on a VPN or privacy tool that is supposed to mask their real public IP, and WebRTC reports an srflx candidate matching the true public IP instead of the VPN exit, that is a leak. The verdict changes with intent — the same candidate can be benign or a leak depending on whether a VPN is in play.