What is a WebRTC leak, and how do I stop it?
You turn on your VPN, check your IP, and it shows the VPN's address. Good. But a page can still ask your browser a different question, through WebRTC, and get a different answer. That difference is the leak.
What WebRTC does
WebRTC is the browser feature behind video calls and screen sharing in tools like Google Meet and Microsoft Teams on the web. To connect two people directly, each browser has to work out which addresses it can be reached on: its address on the local network, and the public address the internet sees. It finds the public one by asking a small public server, called a STUN server, “what address do you see me coming from?”
A web page can start this process without asking permission and without using your camera or microphone. It just reads the answers.
How the leak happens
Whether this happens depends on what kind of VPN you use:
- A VPN app that covers the whole device sends all traffic, including WebRTC's question, through its tunnel. The STUN server sees the VPN's address, and there's nothing to leak. This is the normal case for reputable VPN apps with their default settings.
- A browser extension “VPN” is usually a proxy for web pages only. WebRTC's traffic isn't web-page traffic, so it can go around the proxy and show your real address. This is the classic leak.
- A VPN with split tunnelling (some apps or sites excluded) can leak the same way if the browser is excluded.
What about local addresses like 192.168.1.20? Older browsers handed those to any page too. Current Chrome, Edge, Firefox and Safari hide them behind random names ending in .local unless you've allowed the page to use your camera or microphone, so that part of the old problem is mostly gone.
Test it
The homepage of iplover runs the test in your browser: it asks Cloudflare's STUN server (the same company that hosts the site), collects every address WebRTC reports, ignores the random .local names, and compares the rest with the public address our server saw for your page request. Three outcomes are possible:
| Result | What it means | What to do |
|---|---|---|
| No leak | WebRTC reported nothing beyond the address websites already see | Nothing. |
| Leak found, listing an address | WebRTC can reveal an address different from your public one | If you're on a VPN and the listed address is your real one, fix it below. If you aren't on a VPN, it may be your IPv6 address or a second connection; that's not a privacy leak. |
| WebRTC isn't available | The browser blocks it (or it's switched off) | Nothing: nothing can leak through it. |
Run it twice, with the VPN on and off. If the address listed with the VPN on matches the one shown with it off, that's your real address leaking.
Stop it, browser by browser
- Any browser: use a full-device VPN app instead of a browser extension, and keep split tunnelling off for your browser. This fixes the cause rather than the symptom.
- Firefox: advanced users can switch WebRTC off entirely in Firefox's advanced configuration. That also stops web video calls in Firefox until you switch it back. Mozilla describes the setting on its WebRTC privacy page; settings like this can change between versions, so check it there.
- Brave: its privacy settings include a choice of how WebRTC may use your network addresses, including an option that keeps WebRTC from going around a proxy. Brave explains the options in its WebRTC settings documentation.
- Chrome and Edge: there's no switch for this in the normal settings. Organisations can control it centrally with Chrome's WebRtcIPHandling policy. Extensions that limit WebRTC exist; check who publishes one before you install it.
- Safari: already hides local addresses; for your public address, use a full-device VPN.
After any change, run the test again to make sure it did what you expected.
What a WebRTC leak can't do
The leak reveals an address, the same thing every website sees when you're not on a VPN: roughly where you are and which provider you use. It doesn't expose your files, your passwords or your browsing history. It matters if the point of your VPN is that sites mustn't learn your address, and hardly at all if you use a VPN only to protect public Wi-Fi.
Sources
Official documents we used to check the facts in this guide.