IP address
Comparing your visible IP, location, and ISP.
What is a VPN leak?
A VPN leak happens when traffic or network information that should use the encrypted tunnel takes another route. The important comparison is your baseline: if the same non-VPN address, provider, or DNS resolver remains visible, the result needs investigation.
Common VPN leak signals
- IP address: The public address from your regular connection remains visible, potentially revealing your ISP and approximate network area.
- DNS: DNS requests use your ISP's resolver instead of the VPN or the resolver you intentionally selected.
- WebRTC: Your browser reveals a public network candidate through peer-to-peer setup. Compare it with your baseline before calling it a leak.
- IPv6: Your browser reaches websites over IPv6 while the VPN only carries IPv4 traffic.
How to test for an IPv6 leak
- Disconnect your VPN, refresh this page, and note any visible IPv6 address and network provider.
- Connect the VPN and refresh again.
- If IPv6 remains visible, compare it with the baseline. A different address associated with the VPN can be properly tunneled; the same non-VPN address or ISP is the warning sign.
- Repeat after switching VPN servers or networks because IPv6 behavior can vary by configuration.
Important: seeing IPv6 is not automatically a leak. The question is whether the visible IPv6 traffic belongs to the VPN path or bypasses it.
DNS leak checklist
This page can show your visible web connection and browser-side WebRTC exposure. A full DNS leak test also needs a unique DNS hostname and authoritative DNS logs. Until IP Jokes adds that infrastructure, use this checklist:
- Your VPN app should have DNS leak protection enabled.
- Your visible DNS resolvers in a dedicated DNS leak tool should belong to your VPN provider or a resolver you intentionally chose, not your home ISP.
- If your VPN supports custom DNS, use the provider's recommended DNS settings or a trusted encrypted DNS resolver.
- After changing VPN servers, rerun the test because DNS behavior can vary by server and device.
What to do when a result needs investigation
If the same non-VPN address, provider, or approximate area remains visible, check the connection in this order:
Switch VPN protocols. Try changing from one protocol to another (for example, from OpenVPN to WireGuard, or vice versa). Some protocols handle leak prevention better than others depending on your device and network configuration.
Enable the kill switch. Most reputable VPNs include a kill switch feature that cuts your internet connection if the VPN drops unexpectedly. Make sure this is turned on in your VPN app's settings.
Try a different server. Sometimes a specific VPN server may have configuration issues. Switch to a different server location and run the test again.
Disable or limit WebRTC in your browser. If you're experiencing a WebRTC leak, you can disable WebRTC in your browser settings, use stricter browser privacy settings, or install a browser extension that blocks WebRTC requests.
Check IPv6 settings. If your VPN does not support IPv6, enable IPv6 leak protection in the VPN app or disable IPv6 on the device until you choose a VPN that handles it properly.
Contact your VPN provider. If leaks persist after trying these steps, reach out to your VPN provider's support team. Persistent leaks may indicate a deeper issue with the VPN software or your network setup.
What to look for in a VPN
Look for documented DNS handling, a kill switch, clear IPv6 support, and practical browser guidance for WebRTC. Independent security audits provide useful evidence, but they still describe a particular scope and point in time.
Not sure where to start? Read our guide to what VPNs hide before comparing providers. The boring details matter here, and that is exactly where privacy tools either earn trust or quietly trip over their shoelaces.