What can WebRTC expose?
WebRTC enables real-time audio, video and data between browsers. To establish a connection, the browser collects ICE candidates: local interface addresses, LAN addresses, public reflexive addresses obtained through STUN, and TURN relay addresses.
If the browser exposes a real public address while a proxy or encrypted tunnel is active, or reveals a private LAN address, that can be a leak signal.
How does the check work?
The page creates a temporary RTCPeerConnection, collects candidates and classifies them. It compares candidates with the current public IP and separates hidden addresses, mDNS names, private addresses, public reflexive candidates and relay addresses.
Candidates are used only for the local verdict and are not uploaded; the connection is closed after the check.
How do I read the result?
Seeing 0.0.0.0, :: or .local usually means the browser hid the real address, which is protection working. A private address such as 192.168.x.x is a mild leak signal; a public address that differs from your current egress deserves more attention.
If no candidates are collected, a browser policy, corporate network or unreachable STUN server may be responsible. That is not automatically “safe”.
How can I reduce WebRTC leaks?
Check the browser’s WebRTC policy, whether the proxy covers UDP, whether mDNS hiding is enabled, and whether an extension forces local addresses to appear. Settings vary by browser and OS; no single configuration guarantees every scenario.
When evaluating a proxy environment, also run the DNS leak test and VPN / proxy detection.
Frequently asked questions
Does 0.0.0.0 mean a leak?
No. It usually means the browser did not expose a real address; protection is active.
Why were no candidates collected?
WebRTC may be disabled, a corporate policy may block it, STUN may be unreachable, or the network may block UDP. No candidates is not proof of safety.
Can it reveal my LAN IP?
If the browser does not use mDNS hiding, candidates can include private addresses such as 192.168.x.x. That is a mild leak signal.
Does it work on mobile browsers?
Browsers with WebRTC support usually work, but candidate-hiding policies differ by platform, so results can differ from desktop.
Run a DNS leak test too
WebRTC and DNS are different leak paths. Check both to get a fuller picture of browser egress consistency.