VPN Leak Test
Six live checks on this connection: exit IP, WebRTC, IPv6, timezone, locale and DNS, with a fix for each one that fails.
Built from this run: your exit address, the IPv6 exit, every address WebRTC offered and each DNS resolver that reached our nameserver. Green links stay in your exit network. Click a node to open its check.
How the leak test works
The test runs in this tab against your real connection. Your exit address is read once per run and shared by all three panels, with the time it was taken shown above them. The exit IP check runs first, because every other check compares against it.
- Exit IP. Our API at vpn.pwnsy.com reports the address your request arrived from, its network (ASN), location, reverse DNS and whether that network is a known VPN provider, a datacenter or a Tor exit.
- WebRTC. The page opens a peer connection to Google's public STUN server and gathers ICE candidates for up to eight seconds. Any public address that is not your exit is looked up; a different address in the same network as your exit passes, and one in another network is a leak.
- IPv6. Two single-family endpoints (api4 and api6.ipify.org) report which address IPv4 and IPv6 each leave from. The two networks are compared.
- Timezone. Your browser's timezone and current UTC offset are compared with the timezone mapped to your exit IP.
- Locale. Your browser language list is compared with the languages common in the exit country.
- DNS resolvers. The page looks up five unique names under dnsleak.pwnsy.com. No resolver has them cached, so each one walks to our own authoritative nameserver, which records the resolver addresses. The page reads the result after about three seconds and keeps polling for up to about nine.
The Exit IP and network panel adds the registry record, reverse DNS, routing and request headers for the same address. The Browser fingerprint panel scores the signals a site can read from this browser without a cookie. Each panel loads and retries on its own.
How to read the result
- Pass (green): the check completed and found nothing leaving outside your exit path.
- Check this (amber): no proven leak, but something you should confirm, such as one DNS resolver network that differs from your exit network, or a browser language that does not fit the exit country.
- Leak (red): proven. Examples are a consumer ISP exit while you say a VPN is on, a WebRTC address in another network, IPv6 leaving through a different network, a clock offset that differs from the exit location, or DNS lookups from more than one network.
- Not proven (blue): the check could not reach a conclusion, for example because a blocker stopped it or no resolver reached our nameserver. It is never a pass.
A clean run covers this browser, this network and this moment. Fingerprinting, logged-in accounts, cookies and provider logs sit outside any leak test.
VPN leak test FAQ
What counts as a DNS leak?
Your lookups reaching our nameserver from more than one network. A tunnel that owns DNS gives one resolver network; a second one, usually your ISP, sees every site you visit. One resolver network that differs from your exit network is marked check this, because it is fine when it belongs to your VPN and a leak when it belongs to your ISP.
Why does the test ask whether I am on a VPN?
The exit IP and IPv6 verdicts depend on it. A consumer ISP address is a leak when you say a VPN is on and expected when you say it is off, and IPv4 and IPv6 leaving through different networks is a leak with a VPN on and can be normal without one. Switching the answer re-reads those two checks without running DNS again.
Why does DNS say not proven?
No resolver reached our nameserver while the page waited, or every lookup went to one public resolver such as Cloudflare or Quad9. A content blocker, browser secure DNS or a Private DNS setting can cause either. Not proven is not a pass, so run the test again or check the DNS card for detail.
How do I fix a WebRTC leak?
Enable the WebRTC protection in your VPN app or extension. In Firefox you can set media.peerconnection.enabled to false, and uBlock Origin has a setting to prevent WebRTC leaking the local IP. Run the test again after each change.
Does a clean result mean I am anonymous?
No. A clean run means no leak on this browser, on this network, at this moment. Fingerprinting, logged-in accounts, cookies and provider logs sit outside any leak test, and another app, an extension proxy or a split-tunnel rule can still leave by a different route.
What do the other two panels show?
The same run, read from one exit snapshot. Exit IP and network shows who owns your exit address, its registry record, reverse DNS and routing. Browser fingerprint scores the signals a site can read from this browser without a cookie. Each panel loads and retries on its own.
Network data from Team Cymru, ipwho.is and the Tor Project; address families via ipify; WebRTC via Google's public STUN server; DNS via our own authoritative nameserver for dnsleak.pwnsy.com; registry records over RDAP and reverse DNS via dns.google.