WebRTC leak: what it is and how to check your browser

WebRTC lets browsers make video calls and send data directly to each other. To connect two devices it gathers network addresses, and a page can read some of them. In the past that exposed local and sometimes real public IP addresses, even behind a VPN.

Check your browser right now

Checking your browser…

How WebRTC finds addresses

To connect two browsers, WebRTC collects so-called ICE candidates: the local address of the device in its network, the public address as seen by a STUN server, and relay addresses. A page can create such a connection without any call and read the candidates the browser produces.

Local address leak

A local address such as 192.168.1.23 does not reveal where you are, but it helps tell your device apart from others behind the same router and has been part of many fingerprints. Modern browsers hide it by default: Chrome, Edge and Firefox replace it with a random name ending in .local (mDNS), and Safari does not expose it without camera or microphone permission.

Public address leak behind a VPN

The more serious case: a STUN request goes out by a route that bypasses the VPN tunnel and returns your real public address. Whether that happens depends on how the VPN is set up. Apps that route all traffic through the tunnel prevent it. Browser extensions sold as VPNs are usually proxies for browser traffic only, and they do not cover WebRTC unless they also change the browser WebRTC policy.

How to check

The SpoofLens check on this page and the My IP page gather WebRTC candidates locally, without contacting any external STUN server. They show whether your local address is visible, hidden behind mDNS or not available at all.

Because no STUN server is used, these pages test the local address leak. A full public address leak test needs a STUN server of our own and is planned for a later version.

How to fix a leak

Keep your browser updated: current versions hide local addresses by default.
Use a VPN app that routes all system traffic, not just a browser proxy extension, and turn on its leak protection if it has one.
In Firefox you can switch WebRTC off entirely with media.peerconnection.enabled = false in about:config. Video calls in the browser will stop working.
In Chromium-based browsers, an extension that sets the WebRTC IP handling policy can limit candidates to the proxied route.

For website owners

A public WebRTC address that differs from the address of the connection is a strong sign of a VPN or proxy. A visible local address only means the browser does not hide it. Neither means fraud on its own: many people use VPNs for privacy.

Frequently asked questions

Can WebRTC leak my IP when I am not on a call?: Yes. Any page can start gathering candidates without a call and without showing anything, which is why browsers now hide local addresses by default.
Is mDNS hiding enough?: For local addresses, in most cases yes. It does not protect against a public address leak through a VPN that does not cover all traffic.
Does SpoofLens contact a STUN server?: No. The check stays inside your browser and our own server, which is also why our pages work under a strict Content Security Policy.