VPNTest.orgIndependent VPN Measurements

How to check if your VPN is leaking

A VPN can hide your address and still let a few things slip round it. These are the three leaks people ask about, how to check each one yourself, and what to do if you find one.

What a leak is

A leak is traffic that goes round the VPN instead of through it, so something outside can still see your real address, or the names of the sites you visit. Each check below compares the VPN off with the VPN on, the same way as the VPN IP test. Do that one first: a VPN that does not change your address has nothing worth testing yet.

DNS leaks

Before your device can open a website it asks a DNS server to turn the name into an address. With the VPN on, those questions should go to the VPN's DNS server. If they still go to your internet provider's, or to one set on your router, that server can see every site name you look up, even though the pages themselves are protected.

Check it by hand

  1. With the VPN off, open a terminal and run nslookup -type=txt o-o.myaddr.l.google.com (Windows, macOS and Linux). On macOS or Linux you can use dig +short TXT o-o.myaddr.l.google.com instead. It asks one of Google's name servers (theirs, not ours) a question whose answer is the address that asked, so what comes back is your DNS server's address, not yours. Note the answer and, with nslookup, the Server: line at the top.
  2. Turn the VPN on and run the same command again.
  3. Compare. Some DNS servers add a line starting edns0-client-subnet, which is your own network as your DNS server passed it on. The address will not be the very same every time (a big provider answers from many addresses), so look at whose network it is, not at every digit.

What a leak looks like

With the VPN on, you still see your own side: an edns0-client-subnet line naming your home network, or an answer from the same DNS server and network as with the VPN off. If instead the answer is an address in the VPN's network and your home network is nowhere in the output, your lookups are going through the VPN. (A public DNS server you chose yourself, such as 8.8.8.8, also shows up the same way: that is your choice, but it is not the VPN's.)

How to fix it

Look in the VPN app's settings for a DNS or "leak protection" option and switch it on. Remove any DNS servers you set by hand on the device or the router, because they can override the VPN's. Then run the check again.

Coming soon: our own DNS leak test. It needs a name server of our own, which our website cannot be, so it waits on a small server we have not set up. Until then the steps above use Google's.

WebRTC leaks

WebRTC is the part of your browser that handles video calls and file transfers without a plug-in. To set up a call, a page can ask the browser for your network addresses. Modern browsers hide your address on your home network behind a random name, but a page can still learn your public address, and in some setups that is your real one even with the VPN on. It happens most with a VPN that is a browser extension or proxy, because that only covers the browser's web traffic, not the other kind WebRTC uses.

Check it by hand

There is no command that shows it: a web page has to run WebRTC to see what it can learn. We do not have such a page yet, and we do not send you to ones we have not looked at, so for now we cannot give you a check you can run.

What a leak looks like

With the VPN on, a WebRTC test lists the address you saw with the VPN off (from the VPN IP test) instead of only the VPN's.

How to fix it

In Firefox, type about:config in the address bar, search for media.peerconnection.enabled and set it to false. That turns WebRTC off completely, so calls in the browser stop working. Other browsers have no such switch: look in their privacy settings for a WebRTC option, or use the VPN's app for the whole device instead of its browser extension.

Coming soon: our own WebRTC test, with the visitor tools. It has to ask a public server which address it sees, which would be a request to another site, so how we do that is still to be decided.

IPv6 leaks

Addresses come in two kinds: the older IPv4, such as 203.0.113.7, and the newer IPv6, which is longer and has colons in it. Many connections have both. A VPN that only handles IPv4 can leave your IPv6 traffic going straight out, with your real IPv6 address on it.

Check it by hand

  1. With the VPN off, run curl -g -6 "https://[2606:4700:4700::1111]/cdn-cgi/trace" (on Windows, type curl.exe). It is Cloudflare's own page again, at its IPv6 address. If it prints lines of text, look at ip=: a long address with colons is your IPv6 address. If it fails with an error such as "Failed to connect" and no lines of text, your connection has no IPv6, so there is nothing to leak and you can stop here.
  2. Turn the VPN on and run the same command.
  3. Compare the two.

Use the number, not a name. Given a name, some computers quietly connect over IPv4 and still print an answer, which makes it look as if IPv6 worked.

What a leak looks like

With the VPN on, the same command prints the same IPv6 address as with the VPN off. If it fails, or prints a different address, nothing is leaking.

How to fix it

Switch on the VPN app's option to block or tunnel IPv6, if it has one. If it does not, turn IPv6 off for your connection in the device's network settings.

Coming soon: our own IPv6 check, with the visitor tools.

What our data shows

Our measurement nodes test VPN servers from inside the tunnel. A leak happens on your device or in your VPN app's settings, so none of our tables can tell you whether yours leaks, and we make no claim that any provider does or does not. What the tables do show is where a server really is, which is what the VPN IP test checks from your side.

See the results, and how we measure.