WebRTC
We open a real peer connection through STUN and watch which addresses the browser is willing to hand over.
running
Find out if your VPNactually hides you
Eight checks straight in the browser: WebRTC, DNS, IPv6, time zone, fingerprint. A score from 1 to 10 in five seconds.
Checking
0.0running
Your address
- Location
- Provider
- Latency
Connection score
0.0out of 10
Critical
You are visible almost entirely
How much to trust this
Every check runs in your browser and on our server, with no plugin and no stored result. A browser cannot see the traffic of other apps, so this measures the web stack, not the whole system.
What is leaking
Checking
WebRTC does not expose the real IP
DNS queries stay in the tunnel
IPv6 does not bypass the VPN
Browser and system share one tunnel
Time zone matches the IP
Local IP is hidden
Browser fingerprint
How your IP reads
What can be done with your personal data?
A leak rarely hits at once. The data is filed into databases, cross-matched, and sold onward.
Resale
Your address, city, provider and browser fingerprint get glued to already leaked records and sold as a package.
Account takeover
Passwords from old breaches are replayed in bulk. A matching device and city helps get past the login check.
Blackmail
Browsing history becomes leverage. The pressure usually lands on people who have something to lose.
Social engineering
Knowing your provider, city and device, someone calls posing as your bank or support. The details are what make it convincing.
Fraud in your name
An account with real history is worth more than an empty one. It gets used to deceive the people who trust you.
Most of these databases settle in closed sections of shadow forums that an ordinary person cannot reach. Data cannot be taken back from there, which makes not leaking it the cheaper option.
Eight checks
What we actually look at
Nothing here needs an install. Everything below runs in five seconds on this very tab.
IPv6
We request an address over IPv6 separately and compare its autonomous system with the IPv4 one.
running
Fingerprint
We draw canvas twice and compare the hashes. If they match, you are recognisable without an IP.
running
DNS
We hit ten random subdomains and collect the resolvers that went out to the network for you.
running
Geography and time
We compare the browser time zone with the offset for your IP. A mismatch gives away the real country.
running
Address reputation
We resolve the autonomous system and check whether the address reads as a datacenter or a home line.
running
Three ways to get found
A leak does not look like an error. The site simply receives a second address, and that one is real.
Your ISP sees everything
Every DNS query goes to the provider. Your browsing history assembles itself, without a single leak.
One IP, everything else different
The site gets an address in Amsterdam, a time zone in Moscow and DNS from your home ISP. That combination is useless.
One consistent profile
Address, DNS, IPv6 and clock all say the same thing. That is when a tunnel actually works.
No install required
Open it on any device, the test only uses what the browser already ships with.
If your score is under eight
Close all eight at once
Leaks are not fixed by browser settings. They are fixed by a tunnel that owns DNS, IPv6 and WebRTC itself. We built one.
- Own DNS inside the tunnel, queries never step outside
- IPv6 either enters the tunnel or is blocked entirely
- A kill switch cuts traffic the moment the tunnel drops
- Router, phone and desktop on a single subscription
Common questions
Do you store my IP?
No. The address is used to compute the score inside that one request. We do not write it to a database or pass it on. Geo enrichment goes through an external lookup, and only the address is sent.
Why does the score change between runs?
Some checks depend on the network: the DNS probe may not arrive, IPv6 may come up late. Those items are marked as no data and drop out of the calculation, which shifts the weight of the rest slightly.
I scored a ten, am I untraceable?
No. A ten means we found no leaks in the browser web stack. Payment details, accounts, behaviour and the traffic of other apps are all outside what a browser can measure.
It says datacenter, is that bad?
Not for anonymity, yes for access. Datacenter ranges are easy to identify, so banks and streaming services tend to add verification or block the login.
Can I test another connection?
The test always measures the device and browser it is open in. To check another device, open vpnsafety.io on that device.