How to read a WebRTC test result

Read a WebRTC test by waiting until gathering finishes, then comparing public ICE addresses with the public IP from ordinary HTTPS. On Privacy Leak Check, only a different public IP is treated as possible leak evidence. Private addresses and .local names are explained, not labeled as confirmed security leaks.

The WebRTC leak test uses RTCPeerConnection and a public STUN server in this tab. Candidates stay in the browser. WebRTC is a legitimate API, not malware. Background: What is a WebRTC leak?.

Do this in order

1. Look up the ordinary address on What is my IP.
2. Open the WebRTC test and wait. An empty list that appears too fast can be a timeout, not a permanent hide. Use Recheck rather than assuming one blank run is a guarantee.
3. Sort what you see into public, private/link-local, and mDNS.
4. Compare only public ICE IPs with the lookup string.

How this site labels outcomes

Public ICE IP matches the lookup. Same public path. Not evidence of an extra leak.

Public ICE IP differs from the lookup. Possible leak evidence: STUN used a different public mapping than ordinary HTTPS. If you use a VPN, this browser’s peer-connection path may not be the VPN exit. Reconnect, disable split-tunnel exceptions for this browser, and test again. The fix guide is the checklist.

Only .local hostnames. mDNS hiding of local addresses. Expected in many modern browsers. Not a confirmed leak.

Only RFC1918 or link-local addresses (10.x, 192.168.x, 172.16–31.x, fe80::). Local interfaces. Not labeled a confirmed VPN leak here. Details: What do private IP addresses mean?.

No candidates. Could be policy, a blocked STUN path, a browser setting, or a failed gather. It is not proof you are anonymous and not a DNS result.

A reading table

IPv6 candidates

A public IPv6 ICE address is still just an address. Compare it with the IPv6 test and the main lookup. Visibility means connectivity. Dual-stack routes can differ. IPv6 exposure vs a VPN leak.

What the result is silent about

• Whether a VPN app’s toggle is on
• Whether DNS is protected
• Whether other applications use WebRTC
• Whether you should disable WebRTC (that can break meetings; it is a product trade-off, not malware removal)

Turning WebRTC off does not hide the HTTPS public IP. Cookies still identify logins.

STUN, TURN, and what “gathering” means

ICE gathering often contacts a STUN server so the browser can learn a public mapping. This site uses a public STUN server for that step. A TURN relay is a different service used when direct paths fail; this MVP is not a full call-quality lab and does not claim to test every relay.

If gathering is slow, wait. If it fails, Recheck. Firewalls, tracker blockers, and enterprise policies can block STUN without meaning you have “fixed a leak.” An empty result is an observation about this run.

Compare HTTPS and ICE on the same network and the same profile. Switching from Wi‑Fi to cellular between the two lookups invalidates the comparison.

Sharing a result

Do not screenshot the full candidate list into a public ticket. Redact. If you compare before and after a VPN, follow How to test privacy before and after a VPN so you change one variable.

Practical takeaway

Read public vs private vs mDNS first. Then compare public ICE with HTTPS. That is the whole careful method. Everything else is commentary, and commentary should stay this side of “definitely leaking.”