What do private IP addresses mean in a browser privacy test?

Private IP addresses in a browser privacy test — typically 10.x.x.x, 192.168.x.x, 172.16–31.x.x, or IPv6 fe80:: — identify a local or link-local interface. On this site they are not labeled as confirmed VPN leaks or as proof that a person has been identified.

A public address that WebRTC advertised and that differs from the ordinary IP lookup is the leak question this project is willing to raise. Mixing those two cases is how exaggerated leak pages lose trust.

Public vs private vs mDNS

Public addresses are routable on the open internet. They are what websites and lookup providers see for HTTPS, and what STUN may return as a mapped address.

Private (RFC1918) IPv4 ranges are used on home routers, offices, and virtual machines. They are not unique on the internet. Millions of LANs reuse 192.168.1.1.

Link-local IPv6 (fe80::/10) is for the local link. Unique-local IPv6 (fc00::/7) is also not a global unicast address.

mDNS names ending in .local are how many browsers hide the LAN address behind a random hostname. That is expected. It is not a confirmed leak here.

The WebRTC leak test gathers ICE candidates that may include any of the above. How to read a WebRTC test result maps those buckets onto this site’s labels.

Why a privacy test shows them

WebRTC tries to find paths for a peer connection. A host candidate can be the address of the Wi‑Fi interface. That is useful for talking to another device on the same LAN. It is not a WAN leak by itself.

NAT still exists: the router has a private LAN side and a public WAN side. Seeing the LAN side in ICE is closer to “the browser knows its interface” than “the internet knows your living room.”

Observation vs inference vs certainty

Observation: “ICE included 192.168.1.23.”

Inference: “This browser has a local IPv4 interface in that range.”

Not proven: “The VPN failed,” “the ISP can see that LAN address from ICE,” or “this is a DNS leak.”

This project does not test DNS leaks. Do not translate a private ICE candidate into a DNS story.

VPN users

A VPN can still be covering HTTPS while WebRTC lists a LAN address. That combination is common and not scored here as a confirmed leak.

A VPN user should worry more about a public ICE IP that still looks like the ISP while the HTTPS lookup shows a VPN exit — or the reverse. That is a different public mapping. See What is a WebRTC leak? and the troubleshooting guide.

IPv6 fe80:: is not a global leak. A global IPv6 address is a connectivity fact; read IPv6 exposure vs a VPN leak before calling it a leak.

Typical private ranges you may see

A VPN can assign a private address inside the tunnel. Seeing 10.x after connect can be the tunnel adapter, the LAN, or both. The label “private” still does not mean “leaked to the internet.” The public mapped address, if any, is the one to compare with HTTPS.

Loopback (127.0.0.1, ::1) is this machine talking to itself. It is not a WAN identity.

What you should not do

• Do not paste the full ICE list into a public forum.
• Do not treat 192.168.1.1 as a unique identifier of your household on the internet.
• Do not disable WebRTC solely because a private address appeared, unless you accept broken calls and understand you still have an HTTPS public IP.

Practical takeaway

When a privacy test prints a private address, read it as local interface information. Keep the word “leak” for a public address that disagrees with ordinary HTTPS. That split is the whole point of an honest WebRTC page.