I Built a Free WebRTC Leak Test (And Why Your VPN Might Be Lying to You)

You pay $10 a month for a VPN. You think you're safe.

But a single line of JavaScript on any website can still see your real IP address. It's called a WebRTC leak, and most VPN users don't even know it exists.

I found out about this while building a privacy tool suite. I added a WebRTC test because I wanted to know if my own VPN was actually working.

Spoiler: it wasn't.

What is WebRTC?

WebRTC (Web Real-Time Communication) is the browser technology that powers video calls, voice chat, and peer-to-peer file sharing. It's what makes Google Meet, Discord, and WhatsApp Web work without any plugins.

To establish a direct connection between two browsers, WebRTC needs to know the network addresses on both ends. So it asks the browser for:

Your local IP (like 192.168.1.5)

Your public IP (the one your ISP assigned you)

The second one is the problem. Even if you're behind a VPN, WebRTC can still fetch your real public IP through a separate channel. This is called a WebRTC leak.

Why this matters

Your VPN is supposed to hide your real IP. That's the whole point.

If a website can detect your real IP through WebRTC, then:

• Advertisers can identify you across VPN sessions

• Websites can geo-locate you to your real city

• Malicious actors can target your real network

Your VPN bill is basically wasted.

How the test works

The core API is RTCPeerConnection. Here's a simplified version:
javascript

const pc = new RTCPeerConnection({
  iceServers: [{ urls: 'stun:stun.l.google.com:19302' }]
});

pc.onicecandidate = (event) => {
  if (event.candidate) {
    const ipRegex = /([0-9]{1,3}(\.[0-9]{1,3}){3})/;
    const match = event.candidate.candidate.match(ipRegex);
    if (match) {
      const ip = match[1];
      console.log('Detected IP:', ip);
    }
  }
};

pc.createDataChannel('');
pc.createOffer().then(offer => pc.setLocalDescription(offer));

What this does:

1. Creates a new peer connection with a STUN server
2. Registers a listener for ICE candidates (network paths the browser found)
3. Each candidate contains an IP address — often the real one, not the VPN's
4. We extract the IP with a regex and log it

The tool then compares that IP against the public IP your browser normally reports. If they're different, you have a leak.

The comparison logic

Simple version:

Public IP (from a normal API call): what your VPN shows the world

WebRTC IP (from ICE candidate): what the browser actually knows about your network

If they match → your VPN is working.
If they differ → your real IP is leaking.

You can also detect the local IP (192.168.x.x). That's less dangerous, but it reveals what router you're behind.

Why I built this client-side

Most IP leak tests are free — until they aren't. They log your IP, sell the data, or ask you to create an account to see the full results.

I wanted something different. So I built it into EvoTechTool, my free tool suite.

The whole test runs in your browser. No backend, no logs, no server. The check happens on your device and the results stay there. You can verify this by opening your browser's DevTools and watching the network tab — nothing leaves your machine.

You can try it here: https://evotechtool.pages.dev/whats-my-ip.html

Turn off your VPN, run the test, note your IP. Turn on your VPN, run it again. If the IP is the same, your VPN is leaking. If it's different, you're good.

What other leaks exist

WebRTC is not the only one. Browsers leak through:

DNS — requests may go through your ISP even with a VPN active

IPv6 — if your VPN only tunnels IPv4, your real IPv6 address can still leak

Browser fingerprinting — identifies you without needing an IP

Time zone and language — two pieces of data that narrow your location significantly

I check time zone and language in the tool too, because they're often what gives away your VPN.

The bigger picture

WebRTC is a good technology. Video calls without plugins are great. But the trade-off is that your browser knows more about your network than you might want it to share.

Understanding that trade-off is the first step to fixing it.

If you use a VPN for privacy, run the test. If it fails, switch to a VPN that handles WebRTC properly, or disable WebRTC in your browser settings.

And if you're a developer building privacy tools — don't make your users sign up to see their own IP.

What other browser APIs do you think developers use without understanding the privacy trade-offs?

I built this as part of EvoTechTool, a free suite of browser-based tools (QR generator, password generator, IP checker, username generator) from SAAZone Studio in Dhaka, Bangladesh. Everything runs client-side. No signup, no tracking, no server.