Detect WebRTC IP leaks that can expose your real IP address even behind a VPN. Shows local, public, and ICE candidates.
This tool opens a WebRTC peer connection in your browser, points it at a STUN server, and collects every ICE candidate the browser hands back: local host addresses, the server-reflexive address STUN sees as your public IP, and any relay address if a TURN server is in play. People running a VPN often expect a clean report and are surprised to still see their real public IP in a reflexive candidate - that happens when the VPN doesn't force browser traffic through its own tunnel, which is a gap in the VPN client, not something this page can patch.
The tool creates an RTCPeerConnection configured with a public STUN server, opens a data channel to force candidate gathering, and calls createOffer/setLocalDescription. Each event fired at onicecandidate carries a candidate string encoding an IP, port, and type (host, srflx, or relay). The tool parses these strings and lists every unique address exposed, independent of what the address bar or VPN client reports.
Current Chrome and Firefox replace the real local-network IP in host candidates with a randomly generated hostname ending in .local, resolvable only via multicast DNS on the same network. The tool cannot reverse this hostname back to a raw IP; it reports whatever the browser hands it. Seeing a plain private-range IP instead of a .local name usually points to an older browser, a changed flag, or a non-browser WebRTC client.
Compare it to the exit IP your VPN reports elsewhere. If the candidate IP matches your VPN's exit IP, the STUN request went through the tunnel and nothing leaked. If it matches your ISP-assigned IP instead, your browser is reaching STUN outside the tunnel and that is a real leak.
Because current Chrome and Firefox versions replace it with a randomized mDNS hostname (something.local) by default as a privacy measure, not because this tool failed to detect it. This applies to the local host candidate only; it doesn't affect whether your public IP leaks via the reflexive candidate.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.