WebRTC IP Leak Detector
Check whether WebRTC exposes your real local or public IP address behind a VPN — probes ICE candidate gathering against a public STUN server, entirely in your browser.
Input
Opens an RTCPeerConnection against a public STUN server (stun:stun.l.google.com:19302) and inspects the ICE candidates it gathers for IP addresses. All negotiation happens directly from your browser to the STUN server — no scan data is sent to iotools.
Scan results
Click "Scan for leaks" to run the probe.
Guides
What is a WebRTC IP leak?
WebRTC is the browser technology behind video calls, screen sharing, and other real-time peer-to-peer features. To connect two browsers directly, it needs to know each side's network address — so your browser gathers a list of ICE candidates: addresses it could be reached at, discovered by asking a public STUN server "what does my traffic look like from the outside?"
This gathering happens automatically, via plain JavaScript, with no permission prompt — a page doesn't need camera or microphone access to trigger it. If your browser reports a raw local network address (like 192.168.1.42) in that candidate list, any site you visit can read it, even while you're connecting through a VPN or proxy that otherwise hides your public IP. That's the "leak": your real network information becoming visible despite the privacy tool you're relying on.
Why VPN users care
A VPN's whole job is to swap your visible IP address for the VPN provider's. If WebRTC still exposes your genuine local address underneath, that protection has a hole in it — a site can potentially correlate your VPN session with your real network. This became enough of a concern that modern Chrome and Firefox now obfuscate host candidates by default: instead of a real 192.168.x.x address, they hand out a randomly-generated .local hostname (mDNS) that means nothing to the receiving page. Seeing .local names in a scan is the safe, expected outcome.
How this tool works
Click Scan for leaks to open an RTCPeerConnection against Google's public STUN server and create a data channel purely to trigger ICE gathering. Every candidate the browser reports is parsed and classified as:
- Private IPv4/IPv6 — a real local network address (RFC 1918 ranges, loopback, or link-local). This is the actual leak case.
- Public IPv4/IPv6 — the address a STUN server sees you connecting from. Expected for direct peer-to-peer connections, not a privacy issue by itself.
- mDNS (
.local) — a browser-generated obfuscated hostname standing in for your real local address. The safe, modern default.
If a genuinely private address turns up, you'll see a "your local IP may be exposed" verdict; otherwise the scan reports no leak. All of this runs directly between your browser and the STUN server — no result is sent to iotools' servers.
Why did my scan show a private IP?
Most likely your browser or an installed extension disables mDNS obfuscation for host candidates — common on older browser versions, hardened/enterprise configurations, or a "WebRTC control" extension set to reveal rather than hide the local address. Updating to a current Chrome or Firefox build restores the default protection.
What if a leak shows up while I'm on a VPN?
Your VPN app may not be routing WebRTC/UDP traffic through the tunnel, or your browser has mDNS disabled. Check your VPN client's WebRTC-leak-protection setting, or use a browser extension that blocks WebRTC from resolving non-proxied addresses.
If you also want to check your visible public IP and its geolocation directly, try IP Lookup. To inspect a domain's DNS records, see the DNS Lookup tool, and to decode what a browser's User-Agent string reveals, see the User Agent Parser.