VPN Leak Test
Checks whether your real address, DNS lookups or IPv6 traffic leave outside your VPN, with six live checks on this connection and a fix for each one that fails.
Right now I amThe answer to "Right now I am" changes only the exit IP and IPv6 verdicts. DNS takes about ten seconds.
Starting the leak test
Six checks run against your live connection. DNS takes about ten seconds.
How the leak test works
The test runs in this tab against your real connection. The exit IP check runs first, because every other check compares against it.
- Exit IP. Our API at vpn.pwnsy.com reports the address your request arrived from, its network (ASN), location, reverse DNS and whether that network is a known VPN provider, a datacenter or a Tor exit.
- WebRTC. The page opens a peer connection to Google's public STUN server and gathers ICE candidates for up to eight seconds. Any public address that is not your exit is looked up; a different address in the same network as your exit passes, and one in another network is a leak.
- IPv6. Two single-family endpoints (api4 and api6.ipify.org) report which address IPv4 and IPv6 each leave from. The two networks are compared.
- Timezone. Your browser's timezone and current UTC offset are compared with the timezone mapped to your exit IP.
- Locale. Your browser language list is compared with the languages common in the exit country.
- DNS resolvers. The page looks up five unique names under dnsleak.pwnsy.com. No resolver has them cached, so each one walks to our own authoritative nameserver, which records the resolver addresses. The page reads the result after about three seconds and keeps polling for up to about nine.
How to read the result
- Pass (green): the check completed and found nothing leaving outside your exit path.
- Check this (amber): no proven leak, but something you should confirm, such as one DNS resolver network that differs from your exit network, or a browser language that does not fit the exit country.
- Leak (red): proven. Examples are a consumer ISP exit while you say a VPN is on, a WebRTC address in another network, IPv6 leaving through a different network, a clock offset that differs from the exit location, or DNS lookups from more than one network.
- Not proven (blue): the check could not reach a conclusion, for example because a blocker stopped it or no resolver reached our nameserver. It is never a pass.
A clean run covers this browser, this network and this moment. Fingerprinting, logged-in accounts, cookies and provider logs sit outside any leak test.
VPN leak test FAQ
What counts as a DNS leak?
Your lookups reaching our nameserver from more than one network. A tunnel that owns DNS gives one resolver network; a second one, usually your ISP, sees every site you visit. One resolver network that differs from your exit network is marked check this, because it is fine when it belongs to your VPN and a leak when it belongs to your ISP.
Why does the test ask whether I am on a VPN?
The exit IP and IPv6 verdicts depend on it. A consumer ISP address is a leak when you say a VPN is on and expected when you say it is off, and IPv4 and IPv6 leaving through different networks is a leak with a VPN on and can be normal without one. Switching the answer re-reads those two checks without running DNS again.
Why does DNS say not proven?
No resolver reached our nameserver while the page waited, or every lookup went to one public resolver such as Cloudflare or Quad9. A content blocker, browser secure DNS or a Private DNS setting can cause either. Not proven is not a pass, so run the test again or check the DNS card for detail.
How do I fix a WebRTC leak?
Enable the WebRTC protection in your VPN app or extension. In Firefox you can set media.peerconnection.enabled to false, and uBlock Origin has a setting to prevent WebRTC leaking the local IP. Run the test again after each change.
Does a clean result mean I am anonymous?
No. A clean run means no leak on this browser, on this network, at this moment. Fingerprinting, logged-in accounts, cookies and provider logs sit outside any leak test, and another app, an extension proxy or a split-tunnel rule can still leave by a different route.
Network data from Team Cymru, ipwho.is and the Tor Project; address families via ipify; WebRTC via Google's public STUN server; DNS via our own authoritative nameserver for dnsleak.pwnsy.com.