Skip to content

Is WebRTC exposing your real address?

WebRTC negotiates its own route to the internet, so it can publish an address the proxy never carried. Any page can read it, with no prompt and nothing to click.

Not run

Nothing has been measured yet.

The test opens a peer connection, gathers its ICE candidates against two public STUN servers, and compares every address they reveal with your exit IP.

Runs in your browser. Nothing is kept.
Candidates
-
Public addresses
-
Local addresses
-
Hidden by mDNS
-

01Reading

How it leaks

A second route the proxy never sees.

A proxy configured for HTTP traffic does not constrain the UDP route a peer connection opens for itself.
  • 01

    Server-reflexive candidates carry your public address

    To set up a call, the browser asks a STUN server what address it appears from and publishes the answer as a candidate. If the peer connection bypassed the proxy, that answer is your real address, and the page reads it straight from the candidate.
  • 02

    Turning WebRTC off is a trade, not a fix

    Disabling it closes the leak and breaks every site that needs it, and a browser without WebRTC is itself unusual. The fix that keeps it working is carrying the peer connection through the same proxy as the rest of the session.

VeilBrowser carries each profile's proxy at the browser process, below the page, so WebRTC negotiates through the same exit as every request.

Contact salesNetwork and proxy documentation

More tools