How to Check If Your VPN Is Leaking (DNS, WebRTC, IP)
You're paying for a VPN. You see the little lock icon. You feel safe. But are you?
The uncomfortable truth is that many VPN connections leak identifying information despite appearing active. A significant percentage of both free and paid VPN services fail to fully protect against DNS leaks, WebRTC leaks, or IPv6 leaks — meaning your ISP, websites, and potential attackers can still see who you are and what you're doing.
This guide walks you through exactly what each leak type means, how to test for them, and how to fix them if you find one.
The Three Types of VPN Leaks
1. DNS Leaks — Your ISP Can See Every Site You Visit
DNS (Domain Name System) translates website names like example.com into IP addresses. Normally, your VPN should route all DNS queries through its own encrypted DNS servers. A DNS leak happens when your device sends DNS queries to your ISP's DNS servers instead, bypassing the VPN tunnel entirely.
Even if your web traffic is encrypted, leaked DNS requests reveal every website you visit to your ISP. As the Electronic Frontier Foundation has noted, metadata like DNS requests can be just as revealing as the content of your communications.
Windows is particularly prone to DNS leaks because it lacks a global DNS concept — each network interface can have its own DNS server, and the system process svchost.exe may send queries outside the VPN tunnel.
🔍 Test your DNS right now
Our DNS leak tester shows which DNS resolvers your system is actually using — if your ISP shows up while your VPN is on, you're leaking.
Run DNS Leak Test →2. WebRTC Leaks — Your Browser Betrays You
WebRTC (Web Real-Time Communication) is built into Chrome, Firefox, Edge, and most Chromium-based browsers. It enables video calls and peer-to-peer file sharing directly in the browser — but it has a privacy side effect: to establish direct connections, WebRTC needs to discover your real IP address using STUN server requests.
These STUN requests can bypass your VPN tunnel entirely, exposing your real public IP to any website that runs a few lines of JavaScript. This happens silently, without any notification or permission prompt.
The critical detail: WebRTC leaks occur at the browser level, not the network level. Many VPNs don't protect against them because the leak happens before traffic reaches the VPN tunnel.
🔍 Test for WebRTC leaks
Our WebRTC leak tester uses the same browser APIs that trackers use — if it finds your real IP, so can every website you visit.
Run WebRTC Leak Test →3. IP Address Leaks — The Basics Aren't Working
An IP leak is the most straightforward: your real public IP address is visible despite your VPN being connected. This can happen due to IPv6 leaks (your VPN tunnels IPv4 but your device still sends IPv6 traffic directly), VPN connection drops without a kill switch, or split-tunneling misconfigurations.
🔍 Check your IP address
See your current public IP, ISP, and location. If this shows your real ISP while your VPN is active, you have a leak.
Check My IP →Step-by-Step: Test Your VPN in 5 Minutes
1 Disconnect your VPN and note your real IP address, ISP name, and location using our IP lookup tool. Write these down — you'll compare against them.
2 Connect to your VPN and wait 10–15 seconds for the connection to fully establish.
3 Run the IP check again. You should see the VPN server's IP, not yours. If you see your real IP or ISP — you have an IP leak.
4 Run the DNS leak test. The results should show DNS servers belonging to your VPN provider — not your ISP (Comcast, AT&T, Verizon, etc.). If your ISP's DNS appears, you have a DNS leak.
5 Run the WebRTC leak test. If it shows your real public IP address (the one from step 1), you have a WebRTC leak — even if the other tests passed.
How to Fix Each Leak Type
Fixing DNS Leaks
Most premium VPN apps have a "DNS leak protection" toggle in settings — make sure it's enabled. You can also manually configure your network adapter to use secure third-party DNS servers (like Cloudflare's 1.1.1.1 or Quad9's 9.9.9.9) instead of your ISP's defaults. On Windows, check that your VPN's DNS servers are being used by opening a command prompt and running nslookup to see which resolver responds.
Fixing WebRTC Leaks
The approach depends on your browser. In Firefox, type about:config in the address bar, search for media.peerconnection.enabled, and set it to false. In Chrome, there's no built-in toggle — install uBlock Origin and enable its WebRTC leak prevention option. Brave and Opera have partial mitigations in settings under WebRTC. Safari is stricter by default and generally doesn't leak WebRTC. Tor Browser disables WebRTC entirely.
Fixing IP / IPv6 Leaks
Enable your VPN's kill switch — this cuts your internet connection if the VPN drops, preventing any traffic from leaking. If your VPN doesn't support IPv6, disable IPv6 on your device to prevent it from bypassing the tunnel. On Windows, you can do this in Network Adapter Properties by unchecking "Internet Protocol Version 6."
Important: A VPN Doesn't Hide Your Browser Fingerprint
Even if your VPN passes all three leak tests, websites can still track you using browser fingerprinting. Your canvas rendering, WebGL data, installed fonts, screen resolution, timezone, and dozens of other parameters create a unique identifier that persists across sessions — and a VPN does nothing to change any of them.
A 2025 research paper titled "Breaking the Shield" demonstrated that even browser-level fingerprint defenses like Brave's randomization can be defeated with statistical analysis. The researchers concluded that no fully deployable defense against canvas fingerprinting exists currently.
🔍 See your browser fingerprint
Find out how unique and trackable your browser is — even with a VPN running.
Run Fingerprint Test →When to Test Your VPN
VPN leaks aren't a one-time problem. Test after every VPN software update, when switching VPN servers, after operating system updates, when connecting to a new Wi-Fi network, and periodically (at least monthly). Changes at the OS or browser level can re-enable previously disabled WebRTC or reset DNS configurations.
Frequently Asked Questions
What is a VPN leak?
A VPN leak occurs when your real IP address, DNS requests, or other identifying data becomes visible to websites or your ISP despite having an active VPN connection. The three most common types are DNS leaks (your ISP sees the websites you visit), WebRTC leaks (your browser reveals your real IP through built-in APIs), and IP address leaks (your real IP bypasses the VPN tunnel).
How do I know if my VPN is leaking DNS?
Run a DNS leak test while connected to your VPN. If the results show DNS servers belonging to your ISP (like Comcast, AT&T, or Verizon) instead of your VPN provider's DNS servers, you have a DNS leak. Our free DNS leak test tool can check this in seconds.
Can a VPN protect against WebRTC leaks?
Some VPNs include built-in WebRTC leak protection, but many do not. WebRTC leaks occur at the browser level — the browser reveals your IP through JavaScript APIs before traffic even reaches the VPN. You may also need to disable WebRTC in your browser or install an extension like uBlock Origin.
Does a VPN hide my browser fingerprint?
No. A VPN changes your IP address but does nothing to alter your browser fingerprint. Canvas rendering, WebGL data, installed fonts, screen resolution, and dozens of other parameters can still uniquely identify you across sessions. Use our browser fingerprint test to see how trackable you are.
How often should I test my VPN for leaks?
Test after every VPN update, when switching servers, after OS updates, and at least monthly. Software and system changes can introduce new leaks without warning.