What is a WebRTC leak, and how to check for one

Here’s an uncomfortable fact: you can be connected to a VPN, everything looking fine, and still hand a website your real IP address — through your own browser. The culprit is a feature called WebRTC, and it catches a lot of people who think they’re fully covered.

Where WebRTC comes from

WebRTC is the technology that lets browsers do voice and video calls directly, without a plugin — think in-browser meetings and chat. To connect two people efficiently, it needs to work out the best network path between them, and to do that it asks your device for its IP addresses. That’s a genuinely useful feature working exactly as designed.

The problem is that this discovery can happen from any web page, and it can surface your real IP even while your traffic is routed through a VPN — because it’s asking your operating system directly, sidestepping the tunnel.

Why it undermines a VPN

The whole point of a VPN is that websites see the server’s address instead of yours. A WebRTC leak quietly breaks that: a script on the page can read your true IP even though everything else looks masked. You’d never notice — there’s no error, no warning. It just silently defeats the reason you turned the VPN on.

How to check, and how to fix it

Testing takes seconds. Connect your VPN, then run our Privacy Check, which specifically inspects what WebRTC exposes alongside your visible IP and DNS. If the IP it detects is your real one rather than the VPN server’s, you have a leak.

Fixes, in order of ease: use a VPN that actively blocks WebRTC leaks (ours routes and filters this for you), disable WebRTC in your browser settings or with a trusted extension if you don’t use in-browser calls, or use a browser that lets you turn it off cleanly. Re-run the check afterwards to confirm the leak is closed.