No mismatched public address
No WebRTC candidate exposed a public address different from the connection address during this test.
Test Whether Your Browser Leaks Your Real IP Address
Compares the IP address your connection presents with the addresses WebRTC exposes from inside the browser, so you can see whether a VPN or proxy is actually hiding you.
If you use a VPN, turn it on first, then run the test. A leak is a WebRTC public address that differs from your connection address.
What this browser is exposing
Connection details
Free account
Keep seeing more results
Reveal larger scan previews, run more checks and keep server-generated reports for 30 days. Complete website reports remain Premium.
More resultsMore daily scans30-day history
What this tool checks
16 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.
Browser privacy and policy enforcement
16 checksThe ones that most often decide the grade:
High
Browser version is out of dateYour browser is behind the current stable release, so it is missing security fixes for bugs that attackers already...
Medium
Browser fingerprint uniquenessThe combination of signals your browser exposes matched no other visitor in our sample, so it could be used to...
Low
Canvas fingerprinting exposureYour browser renders a hidden test image identically every time and lets scripts read the pixels back, so the result...
Low
WebGL renderer exposureScripts can read your graphics card model and driver details through WebGL, a strong and long-lived identifying signal.
High
WebRTC IP address leakWebRTC revealed an IP address that differs from the one your connection uses, typically your real address behind a...
Info
Do Not Track signalYour browser is not sending the DNT: 1 header. Most sites ignore the signal in any case, so this is informational.
Low
Global Privacy Control signalYour browser is not sending the Global Privacy Control signal, so sites that are legally required to honour opt-outs...
Medium
Third-party cookies allowedYour browser accepts cookies set by third-party domains embedded in other sites, which is the basic mechanism of...
Low
Full referrer sent cross-siteWhen you follow a link to another site, your browser sends the full address of the page you came from, including its...
Medium
Browser enforces X-Frame-OptionsYour browser displayed a page inside a frame even though that page was served with X-Frame-Options: DENY, so the...
Medium
Browser enforces X-Content-Type-OptionsYour browser executed a script that was served with a non-script content type and X-Content-Type-Options: Nosniff,...
High
Browser enforces Content-Security-PolicyYour browser ran an inline script on a page whose Content-Security-Policy forbids it, so the cross-site scripting...
Low
Browser defaults cookies to SameSite=LaxYour browser sent a cookie that has no SameSite attribute on a cross-site request, so it does not apply the Lax...
Info
User-Agent Client Hints exposureYour browser answers high-entropy Client Hints requests, revealing its exact version, platform version, device model...
Info
Hardware details exposed to scriptsScripts on any page can read your CPU core count, approximate memory, screen geometry, touch capability and in some...
Info
JavaScript disabledJavaScript is off in your browser, so the client-side parts of this scan could not run. That is a strong privacy...
How a WebRTC leak test finds a real IP exposure
The test compares the address used for the web request with public network candidates discovered inside the browser.
WebRTC supports direct audio, video and data connections. To find a route between peers, the browser gathers network candidates. A privacy problem occurs when that process reveals a public address different from the one a VPN or proxy presents to the website.
Scan.now records the public address already visible to the server, asks the browser to gather ICE candidates without joining a call, and compares public candidates with the connection address. Modern browsers often replace private local addresses with mDNS names ending in .local; that behaviour is a privacy protection and is not treated as a leak.
Observe connection IPRecord the public address this web request already exposes.
Gather WebRTC candidatesAsk the browser for ICE candidates without starting a call.
Compare public addressesFlag a different public WebRTC address as a possible tunnel bypass.
Put this result in context
This scanner answers one part of the review. Continue with Browser Check for fingerprint, leaks, version, policies, then Extension Analyzer for permissions, host access, remote code. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.
For the background behind these signals, read WebRTC Leaks: How Your Browser Can Expose Your Real IP Behind a VPN and VPN vs Proxy vs Tor: What Each Hides, What Each Leaks. The Browser version is out of date check reference explains the exact test, evidence and remediation used in the report.
WebRTC and connection signals explained
Public addresses matter most; private and mDNS candidates have different meanings.
| Signal | What it represents | Expected interpretation |
|---|---|---|
| Connection IP | The public address used to request the Scan.now page. | With a VPN, this normally belongs to the VPN provider. |
| Public WebRTC candidate | A public address discovered through ICE candidate gathering. | It should not reveal a different direct ISP address when a full-tunnel VPN is expected. |
| Private candidate | A local-network address such as an RFC 1918 value. | It is not internet-routable but can add fingerprinting context. |
| mDNS candidate | A random local hostname ending in .local instead of a private address. | This shows the browser is masking the underlying local address. |
| No candidate | The browser returned no address-bearing ICE candidate during the bounded test. | WebRTC may be restricted, disabled or simply unable to gather a candidate in time. |
What the WebRTC result means
Run the test with the VPN or proxy already enabled so the comparison reflects the setup you want to verify.
Possible real-IP leak
A different public address appeared in WebRTC. Review the VPN client, routing mode and browser leak protection.
Local address protected
Private or mDNS information may appear without exposing a second public address. The report labels these separately.
Respond to a WebRTC leak
- Enable WebRTC leak protection in the VPN application when it provides that option.
- Confirm the VPN uses a full tunnel rather than excluding browser real-time traffic.
- Retest in a clean browser profile to separate VPN behaviour from extension behaviour.
- If real-time communication is unnecessary, consider browser controls that restrict WebRTC candidate exposure.
What this result does not prove
- The result describes this browser, network and VPN state at the moment the test runs.
- Corporate routing, split tunnelling and IPv4 versus IPv6 paths can intentionally produce multiple public addresses.
- No candidates does not prove that every WebRTC application or future network condition will behave identically.
Related tools
Continue the review with four checks that cover adjacent parts of the same attack surface.
Browser Security & Privacy Check
Fingerprint, leaks, version, policies
Browser Extension Analyzer
Permissions, host access, remote code
Password Strength & Breach Checker
Breach lookup and strength analysis
Phishing URL Checker
Lookalike domains and hidden redirects
Guides for this tool
Background reading written to go with these results.
7 min read · Updated Sep 11, 2026
WebRTC Leaks: How Your Browser Can Expose Your Real IP Behind a VPN
WebRTC lets browsers talk to each other directly, and to do that it discovers your network addresses, sometimes bypassing a VPN. The...
Read the guide
8 min read · Updated Sep 08, 2026
VPN vs Proxy vs Tor: What Each Hides, What Each Leaks
All three route your traffic through another machine, and they protect very different things. This guide compares them on encryption,...
Read the guide
7 min read · Updated Sep 10, 2026
What Your IP Address Reveals and How Sites Use It
Your IP address is sent to every server you contact. What it reveals about location and provider, what it does not, how it is combined...
Read the guide
6 min read · Updated Sep 16, 2026
Secure DNS (DoH and DoT): Stopping Your ISP and Network From Seeing Every Site You Visit
Every website visit starts with a DNS lookup, and by default it is sent in plain text. DNS over HTTPS and DNS over TLS, what they hide,...
Read the guideFrequently asked questions
What is a WebRTC leak?
WebRTC discovers your network addresses to set up direct connections. If it reveals a public IP that differs from your VPN's address, sites can see your real location.
Why does the test show .local addresses?
Modern browsers replace local IP addresses with mDNS names ending in .local. That is a privacy protection working as intended.
My VPN is on but you show two different public IPs. Which is real?
The WebRTC address is the one your operating system routes directly. If it differs from the connection IP, your VPN is not covering WebRTC traffic.
