Free tool
WebRTC leak testis your real address getting out?
Your browser can hand your real IP address to any page you open, over a channel your proxy never touches. This runs that exact exchange, compares what it finds against the address our server saw, and tells you whether the gap is a leak or just your connection having two addresses.
WebRTC leak test
Gathering ICE candidates
Opening a peer connection with no peer on the other end, exactly as a website would, and writing down every address your browser offers. A few seconds.
How the test works
We do what a website would do,and show you the result
No permission prompt, no camera, no microphone. Three lines of JavaScript any page can run without you noticing.
01
We open a peer connection with no peer
The same three lines of JavaScript any website can run, with no permission prompt and no camera or microphone involved. It exists only to make the browser start looking for a route.
02
The browser offers up addresses
To find a route it gathers ICE candidates: the addresses on your own interfaces, and the address a STUN server reports after seeing where your packets actually came from.
03
We compare that against what our server saw
Your HTTP request arrived from one address. If the WebRTC exchange gives away a different one on a different network, that gap is the leak, and we resolve every address to its network before saying so.
Why it happens
The proxy is not broken.The packets are not going through it.
Understanding which part of your setup carries which traffic is what turns this from a scare into something you can fix in one decision.
The leak is a routing problem, not a bug
WebRTC is built for real-time media, so it deliberately talks UDP straight out to the network rather than through whatever HTTP proxy your browser is configured with. That is the right design for a video call and the wrong one for privacy: your page requests go through the proxy and the WebRTC negotiation does not.
A VPN usually covers it, a browser proxy usually does not
A full-tunnel VPN moves every packet, UDP included, so ICE reports the VPN exit and there is nothing to leak. A proxy set in the browser or in a single profile only moves HTTP, which is exactly the configuration most multi-account and scraping setups use, and exactly where this test earns its keep.
Local addresses are already handled
Chrome and Firefox have replaced LAN addresses in host candidates with random .local names since 2019. If you have read that WebRTC exposes your home network, that was true and has not been for years. We report what your browser actually sent rather than the old story.
Two addresses are not automatically two networks
If our edge saw you over IPv6 and WebRTC also finds your IPv4, that is one connection with two addresses, not a proxy failing. We look up the network behind each address and only use the word leak when they genuinely differ.
Questions
WebRTC leak FAQ
What people ask once the result is on the screen, answered against what the test actually measured.
What is a WebRTC leak?
It is when a website learns your real IP address through WebRTC even though your traffic is supposed to be going through a proxy or a VPN. WebRTC finds network routes by talking UDP directly to a STUN server, and an HTTP proxy set in your browser does not carry that conversation. The page then has two addresses for you: the one your requests arrive from, and the one your machine really has.
How do I know if I am leaking?
Compare the two panels above. If the address WebRTC gave away belongs to a different network than the one the site sees, you are leaking. If the only difference is IPv4 against IPv6 on the same network, you are not: that is one connection with two addresses.
How do I fix a WebRTC leak?
Pick one. Use a full-tunnel VPN, which carries the UDP as well, so ICE reports the VPN exit. Disable WebRTC in the browser, which is available in Firefox through media.peerconnection.enabled in about:config and in Chrome only through an extension. Or use a browser profile that routes everything, including UDP, through the proxy, which is what serious anti-detect browsers do. Turning WebRTC off breaks video calls in that browser, so most people keep a second one for them.
Does this test need permission to run?
No, and that is the point. Opening a peer connection and reading the candidates it produces takes no camera, no microphone and no prompt. Any page you visit can do exactly what this one just did, without you noticing.
Why does it show .local addresses instead of my LAN IP?
Because your browser is protecting them. Since 2019 Chrome and Firefox replace local network addresses in host candidates with a random name ending in .local, so a page can still negotiate a connection but cannot read your internal addressing. Seeing those names is a good sign.
I use a proxy in my browser and it still leaks. Why?
Because a browser proxy setting moves HTTP and HTTPS, and WebRTC's route discovery is UDP. The proxy is doing what it was asked to do; the gap is that nobody asked it to carry the STUN exchange, and in most cases it could not anyway. This is the single most common way a carefully configured proxy setup gives itself away.
Does a SOCKS5 proxy help?
It can, because SOCKS5 supports UDP, but only when the client actually routes UDP through it and the proxy really carries UDP rather than just advertising it. Plenty do not. Our UDP proxy checker tests that specific claim on a proxy you paste in.
Do you record the addresses this test finds?
The test runs in your browser and the comparison is shown back to you. We are not building a profile from it and nothing here is tied to an account.
After the test
A proxy that carries everythinghas nothing to leak
If your setup routes UDP as well as HTTP, ICE reports the exit and there is no second address to find. That is a property of how you connect, not of how careful you are.
The upgrade
Residential proxies
$0.44per GB, and the balance never expires
Clean pools with city-level targeting and sticky sessions, running on the same network that just probed your list. You stop re-checking a file every morning, because the addresses are not shared out from under you.
Elsewhere on HProxy
Free proxy list
Thousands of live residential, datacenter and mobile IPs, verified around the clock. Something to test.
Datacenter and ISP
Dedicated IPs priced per address rather than per gigabyte, for work that needs a stable, fast exit.
Mobile proxies
Carrier IPs for the targets that treat everything else as a bot.
API and docs
The same checker and the same pools, wired straight into your own code.
Pricing
Every product on one page, with the volume ladder spelled out.