Free tool
IP leak testis your proxy actually hiding you?
Four checks against the address a website really sees: what WebRTC offers up, whether an IPv6 address is routing around your proxy, and whether a forwarding header is naming you outright. Each one gets its own verdict, so you can see which part of your setup is doing its job.
Four checks, one verdict
Running the checks
Reading the address our edge sees, then gathering ICE candidates the way any page can. A few seconds.
How it works
We look at what a site would look at,and grade each way in separately
One green tick tells you nothing about which check it covered. Four verdicts tell you what to fix.
01
We read the address you arrived on
The one our edge logged for your HTTP request, plus the network that owns it. That is what every site you open already has.
02
We ask your browser what else it will offer
Opening a peer connection makes the browser gather ICE candidates, which is how a page reads addresses your requests never carried. No prompt, no permission.
03
We say which gaps matter and which do not
A second address on the same network is not a leak. A .local name is the browser protecting you. Only a genuinely different network gets called a leak, and the page names the one thing it cannot test.
What leaks and why
Most leaks are not failures.They are traffic that never entered the tunnel.
Nothing breaks, no error appears, and the proxy you are paying for is simply not in the path for that request. That is what makes these worth testing rather than assuming.
The IPv6 gap nobody tests for
Most proxies speak IPv4 only. If your browser also has a working IPv6 address, any site that publishes an AAAA record can reach you over IPv6 and your traffic never touches the proxy. Nothing breaks, no error appears, and the proxy you are paying for is simply not in the path. This is the check that catches it.
A proxy set in the browser moves HTTP and nothing else
WebRTC finds routes over UDP, straight out to the network. That is correct behaviour for a video call and the wrong behaviour for anonymity, and it is why a carefully configured browser proxy can still hand a page your real address.
A transparent proxy names you in a header
X-Forwarded-For exists so the far end can see who is really behind the proxy. Plenty of free and cheap proxies add it. If yours does, every site reads the same line we read, and the proxy is doing the opposite of what you wanted.
Datacenter or residential decides how you are treated
Nothing leaks when your exit sits in a hosting range, but sites that score traffic already assume automation before you have done anything. That is not a leak, it is a starting position, and it is worth knowing which one you are in.
Questions
IP leak FAQ
Including the one this page cannot answer, and why we would rather name that gap than paper over it.
What is an IP leak?
It is when a site learns an address of yours that your traffic was supposed to be hiding. The usual routes are WebRTC, which negotiates over UDP that a browser proxy does not carry, an IPv6 address that your IPv4-only proxy never covered, and forwarding headers that a transparent proxy adds on your behalf. This page checks all three against the address the site actually sees.
Does a clean result mean I am anonymous?
No. It means nothing on this page gave away a second address. Your browser fingerprint, your TLS handshake, your cookies and your behaviour are all separate matters, and a site that wants to identify you has more to work with than an address. We test what we can measure and say so.
Why do you not test for DNS leaks here?
Because doing it properly needs an authoritative nameserver on our side that can see which resolver asked for a random hostname. That is server infrastructure, not something a page can read, and a DNS check that guesses is worse than no DNS check. When we run that nameserver the test will appear here and it will be measured like the rest.
What is an IPv6 leak?
Your proxy carries IPv4, your browser also has IPv6, and the site you are visiting has an AAAA record. The browser prefers IPv6, connects directly, and the proxy is bypassed without anything appearing to go wrong. It is the quietest way to defeat a proxy setup, and it is why this page reports both families rather than just the one you arrived on.
How do I fix a WebRTC leak?
Use a full-tunnel VPN, which carries UDP as well, or disable WebRTC in the browser, which Firefox exposes as media.peerconnection.enabled in about:config and Chrome only allows through an extension, or use a browser that routes everything including UDP through the proxy, which is what serious anti-detect browsers do. Turning WebRTC off breaks video calls in that browser.
My proxy adds X-Forwarded-For. Is that fixable?
Not from your side. The header is added by the proxy itself, so the only fix is a different proxy. An elite or high-anonymity proxy does not add one, which is exactly what the anonymity grade in our proxy checker measures on a list you paste in.
Is this the same as a connection checker?
Yes, that is the other name for it. Address, network, WebRTC, IPv6 and headers in one pass, with a verdict per check rather than a single green tick that hides which part passed.
Do you store the results?
The checks run and the answer is shown back to you. Nothing here is tied to an account and we are not building a profile out of it.
After the test
An exit that carries everythinghas nothing left to leak
IPv6, UDP and headers are properties of the connection you bought, not of how careful you are with it. Getting them right once beats checking them forever.
The upgrade
Residential proxies
$0.44per GB, and the balance never expires
Clean pools with city-level targeting and sticky sessions, running on the same network that just probed your list. You stop re-checking a file every morning, because the addresses are not shared out from under you.
Elsewhere on HProxy
Free proxy list
Thousands of live residential, datacenter and mobile IPs, verified around the clock. Something to test.
Datacenter and ISP
Dedicated IPs priced per address rather than per gigabyte, for work that needs a stable, fast exit.
Mobile proxies
Carrier IPs for the targets that treat everything else as a bot.
API and docs
The same checker and the same pools, wired straight into your own code.
Pricing
Every product on one page, with the volume ladder spelled out.