A VPN that leaks is worse than no VPN at all. Without one, you know your internet provider and the sites you visit can see your real address, and you act accordingly. With a leaky one, you believe you’re hidden when you’re not. That false confidence is the real risk.
The good news is that the common leaks are easy to spot. Below are three checks you can run in about two minutes, in your browser, with no signup and nothing to install. Before you start, have your VPN app open so you can switch it on and off.
What a VPN leak actually is
When your VPN is on, all of your traffic is supposed to travel through an encrypted tunnel to the VPN’s server, and the rest of the internet sees the server’s address instead of yours. A leak is anything that slips out around that tunnel. It might be your real IP address, which reveals your approximate location and your internet provider. It might be a DNS request, the lookup your device makes to turn a site name into an address, which tells whoever answers it which sites you’re visiting. Or it might be a browser feature quietly handing your real address to a web page. The VPN app still says “connected”, but part of what you do is visible anyway.
Test 1: Check your IP address
This is the quickest test, and it catches the most serious problems.
- With the VPN off, check your IP address on our homepage. Write down the IP and the ISP line. That’s your baseline: what websites see when you’re not protected.
- Connect to your VPN and reload the page.
- Compare. The IP should be different, the ISP line should now show your VPN provider or a hosting company, and the location should roughly match the server you picked.
If the ISP line still shows your home or mobile provider, your traffic isn’t going through the tunnel. The VPN may have failed to connect, or it may be using split tunneling, a setting that sends some apps or sites outside the VPN on purpose.
Don’t worry if the city is a little off. IP location databases are often out of date for VPN servers, so a server in Frankfurt might show up as another city in Germany. What matters is that your own IP and provider are gone.
Also look at which IP version the page reports. Some VPNs only tunnel IPv4. If your network also has IPv6, that traffic can bypass the tunnel entirely, and the homepage may show an IPv6 address from your real provider. If that’s unfamiliar, our guide to IPv4 vs IPv6 explains the difference.
Test 2: Check for WebRTC leaks
WebRTC is the technology that lets browsers make video calls and share files directly, without a plugin. To connect two people, a browser needs to know its own public address, so it asks a helper called a STUN server. Any web page can trigger that question in the background. If the request escapes your VPN, the answer is your real IP address instead of the VPN’s.
Our VPN leak test runs this check for you. It asks a STUN server for your public address and compares the answer with the address websites see. Here’s how to read the result:
- No WebRTC leak detected: WebRTC only reported the address you’re already showing, which should be your VPN’s.
- Leak detected: WebRTC exposed a different address. With a VPN on, that’s usually your real one, and any site you visit could collect it.
- Could not run: your browser or an extension blocked WebRTC. That also prevents this kind of leak, but the test can’t confirm it, so treat it as unknown, not as a pass.
One caution: the result only means something with the VPN connected. Without a VPN, a “different” address is often just another address of your own, such as your IPv6 one.
Test 3: Check for DNS leaks
Every time you open a site, your device asks a DNS server to turn its name into an address. With a VPN on, those lookups should go through the tunnel to your VPN’s DNS servers. A DNS leak is when they go to your internet provider instead. Your traffic is still encrypted, but the provider gets a list of every site you visit.
Here’s the honest part: a web page can’t see your DNS traffic. The most it can do is make your device look up a unique test domain and record which DNS server asks for it. Dedicated DNS leak test sites work that way. We don’t run one, because it means logging those lookups, and MyIPSpot doesn’t log. Our leak test has a short DNS leak guidance section instead.
The reliable checks live in your VPN app and your settings:
- Make sure DNS leak protection, or the option to use the VPN’s own DNS servers, is switched on.
- Check that your router or operating system isn’t forcing a custom DNS server that was set by hand.
- If you do use a DNS leak test site, run it several times and on different networks. One clean result is a single sample, not a guarantee.
Test 1 also gives a rough signal. If your real ISP shows up there with the VPN connected, nothing is going through the tunnel, DNS included.
What to do if you find a leak
- Turn on the kill switch. It blocks all traffic whenever the VPN connection drops, so nothing leaks during a reconnect.
- Limit WebRTC in your browser. Use your VPN’s browser extension if it offers WebRTC protection, or a WebRTC-limiting extension. In Firefox, you can set
media.peerconnection.enabledto false inabout:config. - Change server or protocol. A leak can be specific to one server or connection type. Try another, then test again.
- Update the VPN app. Leak fixes often arrive in updates, and older versions can mishandle newer network features in your operating system.
- Contact your provider’s support. Tell them which test failed and what it showed. A good provider will know the fix for your platform.
If nothing works, don’t rely on that VPN for anything where privacy matters. Our guide on how to hide your IP address compares the alternatives.
How often should you test?
Test whenever something changes: after the VPN app updates, after you switch servers or protocols, after a major operating system or browser update, and when you join a new network such as hotel or office Wi-Fi. Leaks usually appear because something changed, not out of nowhere. Beyond that, running the VPN leak test every few weeks takes two minutes and catches problems before you depend on the VPN for something important.
Frequently asked questions
What is a VPN leak?
A VPN leak is when details about your real connection, such as your IP address or the sites you look up, travel outside the VPN’s encrypted tunnel. Websites or your internet provider can then see them even though the VPN app says it’s connected.
Can a VPN leak my IP address?
Yes. It can happen when the connection drops and there’s no kill switch, when split tunneling sends some traffic outside the VPN, when IPv6 traffic isn’t tunneled, or through WebRTC in your browser. Tests 1 and 2 above catch these.
What is a WebRTC leak?
WebRTC is a browser feature for calls and file sharing. It asks a STUN server for your public address, and if that request escapes the VPN, any web page can learn your real IP. You can run the WebRTC check in a few seconds.
What is a DNS leak?
A DNS leak is when your site lookups go to your internet provider’s DNS servers instead of your VPN’s, so the provider can see which sites you visit. The fix is usually in your VPN app’s DNS settings.
Is my VPN working if these tests pass?
It’s working against the most common leaks: IP, WebRTC and the obvious DNS problems. These tests don’t cover everything. Apps outside your browser, brief leaks while the VPN reconnects, and browser fingerprinting, which can identify you without your IP at all, need other checks. Passing is a good sign, not a guarantee.
Do free VPNs leak more?
Not automatically. Leaks come from how well the app is built and maintained, and that varies among free and paid services alike. The bigger question with any VPN is how it pays for its servers, so read the privacy policy and look for an independent audit before you trust it, whatever it costs.