Test if your browser leaks your real IP address through WebRTC APIs even when using a VPN.
This tool opens an RTCPeerConnection in your browser, points it at public STUN servers, and reads back every ICE candidate the browser gathers before any connection is actually made. Each candidate line can contain an IP address, so the test lists what a webpage could learn about you through WebRTC alone, no camera or microphone permission required. The common surprise: a VPN that protects normal browser traffic doesn't always route this UDP-based STUN traffic, so the srflx candidate can show your ISP's real public IP even while your address bar traffic looks fully tunneled.
The tool creates an RTCPeerConnection with a STUN server list, opens a dummy data channel, and calls createOffer() to trigger ICE gathering. Each onicecandidate event fires a candidate string; the tool parses out the typ field (host, srflx, or relay) and the IP address attached to it, then lists them as they arrive.
Chrome and Firefox now replace the real local-network IP in host candidates with a random per-session .local hostname instead of a raw address, a change introduced specifically to stop this class of leak. The tool flags candidates as obfuscated when it sees a .local hostname instead of a dotted IP, so you can tell that behavior apart from an actual exposed local IP.
No. If that IP matches the exit IP your VPN advertises, WebRTC found the correct, expected address and there's no leak. It's only a leak if the IP matches your ISP-assigned address instead of your VPN's, which you can check against a plain 'what is my IP' lookup with the VPN on.
The test itself only contacts the STUN server(s) needed to gather ICE candidates, which is the same request any WebRTC-using site (video call, game, chat) would send; nothing else about the page is transmitted or logged by this tool.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.