VPN Tools: test, build, audit
Thirteen free VPN tools for people who use a VPN and people who run one: check this connection for leaks, look up your exit IP, measure tunnel speed, build WireGuard configs and track exploited VPN appliance flaws. This page runs four quick checks on your connection as it loads.
Your exit address goes to our API at vpn.pwnsy.com for the lookup. The WebRTC and clock checks run in this tab.
Checking this connection
Asking for your exit address, collecting WebRTC candidates and testing each address family. This takes a few seconds.
All 13 VPN tools
13 toolsNo tool matches that search
Try a shorter word such as leak, speed, wireguard or cve.
Start here
Measure this connection.
Build and configure
Generate and tune configs.
Intelligence
Know what is happening out there.
How the quick checks work
When this page opens it runs four checks at once, each on its own, so one slow answer never blanks the others.
- Exit address. The page asks our API at vpn.pwnsy.com which address your request arrived from, then shows its network (ASN), city, country, and whether the address is a Tor exit, a known VPN range or a datacenter range.
- Quick leak check. The browser gathers its WebRTC candidate addresses through a public STUN server for 2.5 seconds. Private and mDNS addresses are ignored. A public address that differs from your exit is looked up, and it only counts as a leak when it sits outside your exit's network.
- Clock vs exit. The timezone your device reports is compared with the timezone of your exit address.
- IPv4 and IPv6 exits. Two endpoints that answer on only one address family each report the address you leave from, and the networks behind both are compared.
The fifth tile reads the newest VPN or remote-access entry in the CISA Known Exploited Vulnerabilities catalogue. The full VPN leak test adds DNS resolvers and browser locale for six checks in all.
How to read the result
- Green means the check passed: no WebRTC address outside your exit network, your clock and exit agree, or both address families leave through the same network (or there is no IPv6 route to leak).
- Red means a leak shape: a WebRTC address outside your exit network, or IPv4 and IPv6 leaving through different networks. Run the full leak test next.
- Amber on the clock tile means your device timezone differs from where your exit address is placed. Sites can read that difference in JavaScript.
- Grey means the check could not run, for example when the exit address lookup did not answer, so there was nothing to compare against. The tile says why. A browser that blocks WebRTC shows green, since that path cannot leak an address.
No page can confirm a no-logs claim, a safe jurisdiction or a tunnel a state cannot break. These tools observe reachability, leakage, timing, packet overhead, published vulnerabilities and what a host answers, and say so when a check cannot prove something.
Where the data comes from
Counts and dates come from the source named; thresholds, grades and wording are ours, with the rule shown on each page.
VPN tools FAQ
Are these VPN tools free, and do I need to install anything?
They are free and run in your browser with nothing to install. Some tools ask our API at vpn.pwnsy.com for a lookup or a live probe. The WireGuard config generator makes its keys in your browser.
What does the quick leak check on this page test?
It collects the WebRTC candidate addresses your browser hands to a page and compares every public one with your exit address. An address in a different network from your exit is reported as a WebRTC leak. The full leak test also checks DNS resolvers, IPv6, timezone and locale.
Why does the clock tile say Mismatch?
Your device reports one timezone and your exit address is placed in another. Any site can read your timezone in JavaScript, so a mismatch hints that you use a VPN or proxy, even when no address leaks.
Can these tools prove a VPN keeps no logs?
No. No page can confirm a no-logs claim, a safe jurisdiction or a tunnel a state cannot break. These tools measure what is observable: leaks, timing, packet overhead, published vulnerabilities and what a server answers.
Which tool should I use if I run a company VPN appliance?
Start with Edge CVE Watch, which matches VPN and remote-access flaws from the CISA Known Exploited Vulnerabilities catalogue and gives each a patch priority. Then grade your configuration with the Config Auditor and check what your endpoint answers with the Endpoint Prober.
Measurement data from OONI, CISA KEV, FIRST EPSS, Team Cymru, ipwho.is and the Tor Project exit list. Active probes run from our own infrastructure. API at vpn.pwnsy.com.