Guides
How to fix a WebRTC leak — and what is not a leak
WebRTC is a standard browser technology for calls and peer connections, documented by MDN as the WebRTC API. It is not a virus. A “possible leak” on this site means ICE candidates exposed a public IP that differs from your ordinary IP lookup. Private addresses and .local mDNS names are explained, not labeled as confirmed security leaks.
To gather a path, the browser may contact a STUN server. WebRTC test does that locally and inspects candidates in this tab. Addresses are not uploaded to this site’s application server. WebRTC is not malware; it is a legitimate real-time communication feature.
Modern browsers often hide LAN addresses behind mDNS hostnames ending in .local. That is expected. Host candidates in 10.x, 192.168.x, or fe80:: identify a local interface. They are not treated here as a confirmed VPN leak.
If you use a VPN, the practical fix is to include WebRTC in the same tunnel as HTTPS, disable WebRTC only if you accept broken calls, or use a browser policy that matches your threat model. This page will not invent a kill-switch guarantee. After changes, compare WebRTC test with What is my IP.
Symptoms and likely causes
| What you see | How this site reads it |
|---|---|
| Public ICE IP differs from What is my IP. | Possible leak evidence: WebRTC used a different public mapping than ordinary HTTPS. |
| Public ICE IP matches the lookup. | Same public address. Not evidence of an extra leak. |
| Only .local hostnames. | mDNS hiding of local addresses. Not a confirmed leak. |
| Only 192.168.x / 10.x / fe80::. | Private or link-local addresses. Not labeled a confirmed security leak here. |
Troubleshooting steps
1. Run the local ICE test once
Open WebRTC test and wait until gathering finishes. Read the verdict. Do not screenshot the full candidate list into a public thread.
2. Compare with the ordinary public IP
What is my IP is the HTTPS path. Only a different public ICE address is treated as possible leak evidence.
3. If you use a VPN, put this browser fully in the tunnel
Split-tunnel exceptions for browsers are a common way STUN still uses the ISP path. Reconnect and test again.
4. Decide whether you still need WebRTC
Turning WebRTC off can break meetings. That is a product trade-off, not a malware removal step. Follow your browser vendor’s documentation if you disable it.
5. Recheck instead of trusting one run
ICE gathering can time out. Use Recheck on the tool page rather than assuming a single empty result is a permanent hide.
How to verify the fix
- After your change, WebRTC test should no longer list a public IP that differs from What is my IP. Matching public IPs, mDNS-only, or private-only results are not scored as confirmed leaks.
- Keep using What is my IP so you know which address ordinary websites see.
- If you also care about IPv6 paths, IPv6 test is a separate connectivity check — still not a DNS leak test.
Affiliate link — we may earn a commission.
FAQ
- Is WebRTC malware?
- No. It is a browser communication API used for real-time audio, video, and data. See the MDN WebRTC API overview.
- Is every address WebRTC finds a privacy leak?
- No. This site only treats a different public IP as possible leak evidence. Private and mDNS addresses are not confirmed leaks.
- Will disabling WebRTC make me anonymous?
- No. HTTPS still has a public IP, and cookies still identify logins. Disabling WebRTC only removes that ICE gathering path.
- Do I need to pay for a special WebRTC fix?
- This page does not sell a numbered discount or claim a unique WebRTC product feature. Use your VPN app’s routing options and then verify locally.
- Does this replace a DNS leak test?
- No. DNS leak testing is not in this MVP. Do not read ICE results as DNS results.