Guides
WebRTC Leak: What It Is, Why It Can Reveal Your IP and How to Test It (2026)
What is WebRTC?
WebRTC is a set of browser features for real-time communication: video calls, voice, and sending data directly between two devices. To connect two devices that sit behind routers and firewalls, it first has to work out how each one can be reached.
How can WebRTC reveal an IP address?
MDN explains the mechanism: a client sends a request to a STUN server on the internet, and the server answers with the client's public IP address. ICE is the framework that uses STUN, and TURN relays data through a server when a direct connection isn't possible. Together they let a web application learn addresses so that two devices can connect.
RFC 8828 names three concerns about what this can reveal:
- Multiple public addresses, especially with split-tunnel VPNs.
- Private network addresses, the ones on your local network.
- Bypassing a proxy and exposing the public address.
What counts as a leak?
| What a test page shows | What it means |
|---|---|
| Only the address your VPN or proxy gives you | No public leak in this test |
| Your real public address next to the VPN or proxy address | A public leak |
| An address like 192.168.x.x or 10.x.x.x | A local network address; less sensitive, still information |
| No addresses at all | WebRTC is off or restricted in this browser |
How do you test in two minutes?
- Turn on your VPN or proxy.
- Look up your IP address with an IP lookup page and note it.
- Open a WebRTC leak test page (BrowserLeaks has one, for example) in the same browser or profile.
- Compare. Any public address other than the one from step 2 is a leak.
- Repeat in every browser and profile you use, and again after changes.
Three example results and what to do
| Scenario | What the test shows | What to do |
|---|---|---|
| Proxy on, WebRTC limited | Only the proxy's address | Keep the setup and re-test after updates |
| VPN with split tunnelling | The VPN address and your real public address | Change the VPN's routing or limit WebRTC, then re-test |
| Proxy on, WebRTC unrestricted | Your real public address next to the proxy address | Limit or turn off WebRTC in that browser or profile, then re-test |
How can you reduce a leak?
- Use a setting or extension that limits WebRTC address exposure, where your browser offers one, and read what it actually does.
- Turn WebRTC off if you never use video calls or similar features. This stops the exposure and breaks those features.
- Follow the safer defaults. RFC 8828 describes four modes. Its recommended default shares the default-route address and its related local address, a stricter mode shares only the default-route address, and the strictest forces traffic through the proxy.
- Re-test after every browser update, because the behaviour can change.
Common mistakes
- Assuming "VPN on" means no leak.
- Testing once, in a different browser from the one you use.
- Mixing up a local network address with your real public address.
- Forgetting to test after changing a proxy or a setting.
- Ignoring that the IP address, time zone and language should tell one story; see Timezone, language and IP address.
Where ADSSPEED fits
Each ADSSPEED profile has its own proxy. After you set a profile's proxy, run the WebRTC test inside that profile, as you would in any browser. If the test shows an address you didn't expect, change the profile's proxy settings and test again. Use it only for accounts you own or are authorised to manage, and follow each platform's rules.
Frequently asked questions
What is a WebRTC leak?
It is when a page uses WebRTC to learn an IP address that your VPN or proxy was meant to hide, such as your real public address or an address on your local network.
Does a VPN prevent WebRTC leaks?
Not automatically. RFC 8828 lists revealing multiple public addresses, especially with split-tunnel VPNs, and bypassing a proxy to expose the public address among the concerns. Test with your own setup instead of assuming.
How do I test for a WebRTC leak?
Turn on your VPN or proxy, look up your IP address, then open a WebRTC leak test page in the same browser and compare. If it shows an address other than the one your VPN or proxy provides, you have a leak.
Is my local network address a leak too?
It is information a page shouldn't need, but it is less sensitive than your real public address. RFC 8828 lists exposing private network addresses as a concern, and its recommended default limits what is shared.
Is it safe to turn WebRTC off?
Turning it off stops the exposure, but it also breaks video calls and other features that rely on it. Switch it off only if you don't use those features, and test the sites you depend on afterwards.
Do I need to test every browser?
Yes. Each browser and each profile can behave differently, and updates can change the behaviour. Test the exact browser or profile you use, and test again after changing proxies or settings.
Sources
Related guides
Run Android devices and browser profiles on your own PC
ADSSPEED manages many browser profiles and Android phone profiles from one app, each with its own device configuration, proxy and automation.