Last updated: July 2026 · 10 min read

What a "VPN leak" actually means

When you turn on a VPN, your device builds an encrypted tunnel to a VPN server and sends your traffic through it. Websites you visit then see the server's IP address instead of your real one, and your internet provider can no longer read what's inside the tunnel. That's the whole point.

A "leak" is any situation where some of your traffic — or the identifying information attached to it — travels outside that tunnel. When that happens, a website, an app, or your ISP can see your real public IP address or the list of sites you're looking up, even though the VPN is switched on and appears to be working. Leaks matter because they defeat the specific thing you turned the VPN on for: breaking the link between your activity and your real identity and location.

Leaks aren't usually a sign that your VPN is a scam. They're more often a mismatch between your VPN app, your browser and your network setup — the kind of gap that only shows up when you actually test for it.

The four kinds of leak worth knowing

Almost every real-world VPN leak falls into one of four buckets. You don't need to be a network engineer to understand them — each one is just a different route your data can take around the tunnel.

1. IP (IPv4) leaks

This is the most basic failure: the site you visit simply sees your real IPv4 address instead of the VPN server's. It can happen if the VPN drops for a moment and reconnects, if a misconfiguration sends some traffic straight to the internet, or if the connection never fully established in the first place. An IP leak is the easiest to spot, because your visible IP and location will match your real ones rather than the server you picked.

2. DNS leaks

Every time you visit a website, your device first asks a DNS resolver to translate the name (like example.com) into an IP address. When the VPN is working, those lookups go through the VPN's own resolver inside the tunnel. In a DNS leak, they escape to your ISP's resolver instead — which means your provider can still see a running list of the domains you visit, even though the rest of your traffic is encrypted. Because those lookups are effectively a log of every site you open, a DNS leak can quietly undo much of a VPN's privacy benefit. We go deeper on this in our DNS leak test guide.

3. WebRTC leaks

WebRTC is the browser technology behind video calls, voice chat and some file-sharing features. To connect two people directly, it needs to discover the real IP addresses of the devices involved, and it does this using something called a STUN server. Security researchers describe this exchange as fundamental to how WebRTC works — it isn't a bug, it's part of the design. The catch is that a web page can quietly run the same process and read your real IP through it, even while you're connected to a VPN. According to Security.org's analysis, Firefox, Chrome, Opera and Microsoft Edge are the browsers most exposed because they enable WebRTC by default. A WebRTC leak is sneaky precisely because everything else can look perfectly fine.

4. IPv6 leaks

The internet is slowly moving from the old IPv4 addressing system to the newer, much larger IPv6. The problem is that plenty of VPNs still only tunnel IPv4 traffic. If your home network and device have IPv6 enabled but your VPN doesn't handle it, your IPv6 traffic can bypass the tunnel entirely and travel out with your real address attached. This one catches a lot of people because it's invisible unless you specifically check for an IPv6 address.

How to test your VPN, step by step

The whole idea of a leak test is simple: compare what the internet sees about you before and after the VPN is on, and confirm that every channel — your IP, your DNS lookups, WebRTC and IPv6 — reflects the VPN server rather than your real network. You can do this by hand in a few minutes.

Step 1 — Note your real details first

With the VPN off, check your baseline. Our IP lookup shows your real public IP address, your rough location and your internet provider. Jot these down — they're the values that should disappear once the VPN is on. It's also worth glancing at what websites see about you so you know the full picture a site can build from a single visit.

Step 2 — Connect and re-check your IP

Now turn the VPN on and connect to a server in a different city or country from where you actually are. Reload the IP lookup page. The IP address and location should now match the VPN server, not your Step 1 values. If your real IP or country still shows, you have a basic IP leak and there's no point testing further until it's fixed — the tunnel isn't carrying your traffic.

Step 3 — Run a full VPN leak test

Rather than checking each channel on a different site, the fastest path is a single combined check. GoIPScan's VPN leak test looks at your visible IP, whether an IPv6 address is exposed, and whether WebRTC is revealing anything — all in one place. Everything it reports should point at the VPN server. Anything that points back at your real network is a leak to fix.

Step 4 — Check DNS separately

DNS deserves its own look because a DNS leak can happen even when your IP looks perfect. Run our DNS leak test while the VPN is connected. The resolvers it lists should belong to your VPN provider or a privacy-focused DNS service — not your home internet provider. If you see your own ISP's name in the results, your lookups are escaping the tunnel.

Step 5 — Test what happens when the VPN drops

The most overlooked test is the one that mimics real life. VPN connections occasionally drop — when you switch Wi‑Fi networks, wake a laptop from sleep, or hit a flaky signal. In that split second, will your device fall back to your real connection or block traffic until the tunnel is back? With the VPN connected, briefly disable your network adapter or toggle Wi‑Fi off and on, then re-run the IP check. If your real IP flashes back into view, your VPN's "kill switch" either isn't enabled or isn't working.

How to fix the leaks you find

Finding a leak is the hard part; most fixes are quick. Work through whichever ones your tests flagged.

Fix a DNS leak

First, make sure your VPN app's own DNS handling is turned on — many apps have a "use VPN DNS" or "DNS leak protection" option that isn't always enabled by default. If your VPN doesn't offer that, you can manually set your device or router to use a privacy-respecting public DNS resolver so lookups never touch your ISP. Re-run the DNS leak test afterwards to confirm the ISP's resolver is gone.

Fix a WebRTC leak

Because WebRTC lives in the browser, the fix does too. In Firefox you can disable it directly: type about:config in the address bar and set media.peerconnection.enabled to false. Chrome, Edge and Opera don't offer a built-in switch, so the usual route is a reputable WebRTC-blocking extension, or relying on a VPN that actively filters WebRTC requests. After making the change, re-run the VPN leak test to check the leak is closed. If you'd like the wider context on how browsers give you away, our browser privacy guide covers it.

Fix an IPv6 leak

You have two clean options. The better one is to switch to a VPN that fully supports IPv6 and tunnels it alongside IPv4. The simpler one is to make sure your VPN has an "IPv6 leak protection" setting enabled, which blocks IPv6 traffic while connected so nothing can escape that way. As a last resort, disabling IPv6 on your device removes the risk entirely, though it's a blunt tool that can affect other services.

Turn on the kill switch

Almost every serious VPN includes a kill switch — a feature that blocks all internet traffic the instant the tunnel drops, so your real IP is never exposed during a reconnect. It's often switched off by default. Enabling it is the single most effective safeguard against the "brief flash" leaks from Step 5, and it costs you nothing but a few seconds of downtime when the connection hiccups.

How often should you test?

You don't need to check every day, but a leak test is worth running at a few specific moments: right after you install or switch VPN providers, after any major update to the VPN app or your browser, and whenever you're about to rely on the VPN for something that matters to you. Updates are the big one — a browser or operating-system change can quietly re-enable a setting you'd turned off. Treat it like checking your car mirrors: quick, occasional, and far better than assuming.

It's also worth keeping expectations realistic. A leak test confirms your VPN is masking your IP and DNS as intended; it doesn't make you anonymous. If you're signed into an account, that account still identifies you regardless of your IP, and your overall browser fingerprint is a separate matter. A VPN is one strong layer, and testing it simply makes sure that layer is doing its job.

Frequently Asked Questions

How do I know if my VPN is leaking?

Connect to a VPN server in another location, then check your visible IP, DNS resolvers, WebRTC and IPv6. If any of them show your real IP address, your real location, or your own internet provider instead of the VPN server, that channel is leaking. The quickest way is to run GoIPScan's VPN leak test and DNS leak test back to back while connected.

Can a VPN leak my IP even when it says "connected"?

Yes. The "connected" status only means the tunnel is up. WebRTC, DNS lookups and IPv6 traffic can each take a different route around that tunnel depending on your browser and network settings, so your real IP can leak while everything looks fine. That's exactly why testing each channel separately is worth the few minutes.

What is a WebRTC leak?

WebRTC is a browser feature for real-time voice, video and peer-to-peer connections. To set those up it discovers real device IP addresses through a STUN server, and a web page can quietly use the same mechanism to read your real IP even behind a VPN. Firefox, Chrome, Opera and Edge are most affected because they enable WebRTC by default. It can be disabled or blocked in the browser.

Is a DNS leak dangerous?

It's more of a privacy problem than a direct security threat. A DNS leak means your internet provider (or whoever runs the resolver your lookups reach) can see the domains you visit, even though the rest of your traffic is encrypted. That undermines a large part of why people use a VPN, so it's worth closing — usually by enabling your VPN's DNS protection.

Do I need to worry about IPv6 leaks?

Only if your network and device use IPv6 and your VPN doesn't handle it — but that combination is common. When it happens, IPv6 traffic can bypass the tunnel with your real address attached. Enabling your VPN's IPv6 leak protection, choosing a VPN that supports IPv6, or disabling IPv6 on the device all close the gap.

Does a kill switch stop leaks?

A kill switch specifically stops the leaks that happen when the VPN connection drops, by blocking all traffic until the tunnel is restored. It won't fix a DNS, WebRTC or IPv6 leak that's present while you're connected — those need their own fixes — but it's essential protection for the moments a connection hiccups, so turn it on.