The test
- Teal VPN
- Checking…
- Public IPv4 address
…- IPv6
- Checking…
- WebRTC addresses the browser offers
- Checking…
- DNS
- Not tested here. Teal VPN sends DNS through the tunnel; see what DNS reveals.
Read in your browser and shown back to you. Nothing is stored. What Teal VPN keeps.
What an IP leak is
A VPN promises that websites see the VPN server’s address instead of yours. A leak is any path that lets your real address, or your real DNS lookups, reach the outside anyway. The tunnel can be perfect and a leak still happen beside it, through the browser or through a protocol the VPN did not cover.
The three kinds
WebRTC. Browsers can open direct connections for calls and video. To do that they collect the addresses they can be reached on and may hand them to a page’s script. A page can read your public address from that list even with a VPN on, unless the VPN or the browser blocks it.
IPv6. Many connections have an IPv6 address next to the IPv4 one. A VPN that carries only IPv4 and leaves the IPv6 route open lets IPv6 traffic go around the tunnel, carrying your real IPv6 address. The right fix is to carry IPv6 too, or to add no IPv6 route at all so nothing can use it.
DNS. If name lookups still go to your provider’s resolver while the VPN is on, the provider sees every site name you open, even though the traffic itself is hidden. A VPN has to send DNS inside the tunnel to its own resolver.
How to fix one
Use a VPN app that routes the whole device, not a browser extension, so WebRTC and every other app go through the tunnel. In Firefox, media.peerconnection.enabled can be switched off; in Chrome an extension can limit WebRTC. Make sure IPv6 is either carried by the VPN or disabled. Check that DNS goes to the VPN’s resolver, not the provider’s.
Teal VPN does all three by design: every app goes through the tunnel, DNS goes through the tunnel, and no IPv6 route is added when the server has none, so nothing can use it. Get Teal VPN
Questions
What is an IP leak?
Your real public address reaching a website while a VPN is on. It happens through WebRTC in the browser, through IPv6 when the VPN only carries IPv4, or through DNS lookups that go around the tunnel. Each one tells the site where you really are.
Does this test send my data anywhere?
The page reads the address Cloudflare already sees on this request and asks the browser for its WebRTC candidates; nothing is stored. The Teal VPN on/off check asks our API one yes-or-no question and keeps nothing.
Does Teal VPN leak?
The apps route every app through the tunnel, send DNS through the tunnel, and add no IPv6 route when the server has none, so IPv6 cannot slip out. If this page shows your real address with Teal VPN on, write to support with the screenshot; that is a bug we want.
Why does my city look wrong?
Location databases map an address to the place the provider registered it, often a hub city. Mobile networks are frequently shown in another city. It is not a leak.
Can a website see my local 192.168 address?
Older browsers exposed local addresses through WebRTC; current Chrome, Firefox and Safari hide them behind a random name, so the test usually shows none. A public address in the WebRTC list while a VPN is on is the one that matters.