Quick answer
A WebRTC leak is best understood as an unexpected public IP disclosure through WebRTC. Browsers use WebRTC for real-time audio, video and peer-to-peer connections. During connection setup, WebRTC gathers ICE candidates that describe possible network paths. If a candidate exposes a public IP that differs from the public IP you intended websites to see, that can defeat part of an IP-hiding setup.
What WebRTC actually exposes
ICE candidates can be host, server-reflexive, peer-reflexive or relay candidates. MDN notes that candidate addresses can reveal information about network topology and can contribute to fingerprinting. Modern browsers also include privacy protections, so a local candidate may appear as a hostname or otherwise be obscured rather than exposing a raw private LAN address.
MDN: RTCIceCandidate address · MDN: ICE candidate types
What counts as a meaningful leak?
Do not treat every WebRTC candidate as a leak. Private addresses such as RFC1918 LAN addresses describe local networking, and modern browsers may obscure them. For VPN testing, the higher-value signal is a different public IP from the normal address shown by the website.
- Check the public IP shown by the website.
- Gather WebRTC ICE candidates.
- Ignore local-only/private candidates for the public-IP comparison.
- Flag a result only when WebRTC exposes a different public address that should have been hidden by the VPN.
Why old “WebRTC leak” articles can be misleading
Many older guides describe WebRTC as if every browser automatically reveals the user's raw local and public addresses. Browser behavior has changed. Privacy mechanisms, mDNS hostnames, relay-only policies and VPN implementations can all alter what appears. That is why our tool reports what the browser actually exposes instead of assuming that “WebRTC enabled” equals “leaking.”
How our WebRTC test works
The CheckWhatIsMyIP VPN Leak Test creates an RTCPeerConnection, gathers ICE candidates, and compares public candidate addresses with the standard public IP seen by the page. If no candidate is available, we report that WebRTC IP information was not detected; we do not treat that as proof of complete VPN security.
How to reduce exposure
- Use a VPN that correctly routes WebRTC traffic. A well-configured tunnel should prevent an unintended public-IP mismatch.
- Keep your browser current. Browser privacy behavior changes over time, and older advice may no longer match current releases.
- Retest after browser or VPN updates. A result is a point-in-time observation, not a permanent guarantee.
- Be careful with extensions that disable WebRTC. They can break video calling and other real-time features, and they are not necessary if the underlying network path is already protected.
WebRTC is only one part of a privacy check
A WebRTC result does not tell you whether DNS queries are leaking, whether another application is using split tunneling, or whether your browser fingerprint is unique. Use it alongside the Browser Fingerprint Test and the public-IP comparison.