What is WebRTC used for?
WebRTC supports real-time browser communication, including calls and data exchange. Camera and microphone use requires the relevant permission. Gathering possible connection addresses is a separate operation: a diagnostic test can prepare a data channel without requesting camera or microphone access. Our WebRTC test examines these visible connection candidates.
What do ICE, STUN and TURN mean?
ICE organises possible connection paths. A STUN service can report an externally observed address to the browser. TURN relays traffic when an application needs it. Our check uses two Google STUN services, but no TURN server or remote call participant. It therefore does not establish that a real video call will work across all those paths.
Which candidates appear in the table?
- host: An address associated with a local interface, or an mDNS name used instead. A global IPv6 address can also belong to an interface.
- srflx: A server-reflexive address observed through STUN. It may belong to a router, provider or VPN exit.
- prflx: A peer-reflexive address observed during communication with a peer. Without a remote peer, it is not normally expected in this check.
- relay: A relay address. This check does not configure TURN access, so a missing relay candidate is not a defect.
Why do I see a .local name?
An mDNS name can replace a local IP in exposed candidates. It is not a public home address. This test does not try to bypass that masking or discover the local IP behind it. A visible private address such as 192.168.1.20 is not a public internet connection address either.
How do I check a VPN connection?
- If needed, note your public IP without the VPN using My IP.
- Connect the VPN, then reload the WebRTC page so that its HTTP reference belongs to the current connection.
- Start the test. The HTTP reference describes the connection used to load the page; it does not automatically cover both IP versions.
- Compare a public IPv4 only with an IPv4 reference, and IPv6 only with IPv6. Without a matching reference family, no direct comparison is possible.
- For a different address, check your VPN's expected exits and settings. Repeat the test after changes.
Is every additional public address a leak?
No. Multiple permitted VPN exits, split tunnelling or different IPv4 and IPv6 paths can explain additional addresses. Conversely, a matching address is not complete proof of protection in every application. What matters is whether an observed address falls outside your expected and intended VPN path. The browser test does not automatically know that expectation.
What do green, yellow and neutral messages mean?
Green with a tick describes a public address matching the HTTP reference for the same IP version. Yellow indicates a difference or limited gathering. Neutral messages describe mDNS, local addresses or a missing reference, for example. Red means a technical failure. None of these messages alone is a complete security assessment of the VPN.
Why are no candidates returned?
Browser policies, extensions, network filters or unreachable STUN services can limit gathering. The attempt ends after at most eight seconds and displays at most 64 distinct entries. A time limit is explicitly marked as a partial observation. You can also cancel gathering. An empty result does not prove protection against leaks, and a STUN error does not automatically indicate a VPN failure.
Which data leaves my browser?
When you load the page, the website sees the source address of its HTTP connection. Only after you start this check does the browser contact stun.l.google.com and stun1.l.google.com on port 19302; those services see the source address of that connection. The test script does not automatically upload the candidate list to our server. A report you copy or share can contain the observed addresses.
What else should I check?
The DNS leak test answers a separate question: which resolvers are observed for the test names. A successful WebRTC observation does not replace that check. Disabling WebRTC entirely can interfere with calls and other applications. Change settings only when you understand their effects, then retest the applications you actually use.