I4∇ROOT
Does your browser leak your real IP? — free, no ads, no sign-up

WebRTC leak test

Testing…

Racing STUN servers and cross-checking against your HTTP address…

— visitors · — checks run, all time — one visit per person per 20 minutes; every test counts. This counter stores a number, nothing about you.

Found something open? Paste your log and get the fix plan →

Your HTTP address

checking…

IPv6: checking…

What STUN sees (WebRTC)

gathering…

IPv6: —

comparing…

Local network

gathering…

—

The checks

STUN race lanes

The permission trap

Modern browsers mask your local address as a random .local name — until a site gets a microphone or camera permission. Then the mask comes off and the real address is exposed. Press to see it happen to you. The permission is released the instant the check ends — nothing is recorded, nothing leaves your browser.

Live diagnostic log & raw ICE candidates 
(run the test first)

Why check it here

One of a kind. We searched and couldn’t find another WebRTC leak test anywhere that does all of this at once: 10 independent STUN operators racing live on your screen — every millisecond visible — with the verdict cross-checked against a 20-server HTTP race. Know one that does? Tell us.

The real test, not a listing. Candidates alone tell you little. This page cross-checks what STUN reports against your HTTP address from independent IP-echo servers — a mismatch is a leak, spelled out in plain words.

A race, not one server. Several independent STUN operators are asked in parallel, every millisecond on screen. One server being down or slow can never block or fake your result — and you watch them agree.

Private by design. Everything runs inside your browser. The only parties contacted are the STUN and IP-echo servers being tested — nothing about you is sent to this site's server, nothing is logged.

Clean. Free. No ads, no account, no cookies, nothing to install. One page that answers one question.

WebRTC leaks, in plain words

What is a WebRTC leak?
WebRTC is the browser technology behind video calls. To connect two people it must discover your addresses — and it does that over its own direct path, outside normal web traffic. A page can trigger that discovery and read the result, which is how your real address can surface even when the rest of your traffic is masked.
I use a VPN — am I safe?
Not automatically. A VPN carries your normal traffic, but WebRTC's STUN lookup can take a separate path that skips the tunnel unless your VPN or browser specifically blocks it. That is exactly what this page tests: run it with the VPN on — the two columns above must show the same address.
What is the .local name in my candidates?
Protection, working. Browsers stopped writing your LAN address into candidates and put a random one-time mDNS name like 1f47….local there instead, after sites abused the address for tracking. Seeing only .local entries is a pass.
Why does a microphone or camera permission matter?
The .local masking applies to sites you haven't trusted. Grant a site capture permission and the browser exposes the real local address to it. The "permission trap" button above demonstrates it on your own machine — and releases the permission immediately.
Is this test private?
Yes, by construction: your browser talks directly to the STUN and IP-echo servers being tested, and the verdict is computed on your screen. Nothing about the result touches this site's server. The only parties that learn you ran a check are the servers that answered — which is the very thing being measured.
I have a leak — how do I fix it?
In order of strength: use a VPN that explicitly covers WebRTC; or set your browser to refuse non-proxied WebRTC routes (Firefox: media.peerconnection.enabled, Chrome: an extension implementing disable_non_proxied_udp); or keep WebRTC off where you don't need calls. Then re-run this page — the verdict should flip.

How it works. Your browser opens one local RTCPeerConnection per STUN operator and gathers the ICE candidates it produces. host candidates describe your local interfaces, srflx candidates carry the public address the STUN server saw. In parallel, your HTTP address is fetched the family-locked way from independent IP-echo servers, so IPv4 and IPv6 can never be confused. The verdict is a comparison: STUN and HTTP agreeing is a pass, an address STUN reveals that HTTP does not show is a leak. Everything runs in your browser; this site's server is not part of the measurement. Also here: What is my IP — the 20-server race. Part of I4ROOT — trance music, 100% human-made.