A WebRTC leak is when your browser reveals your real IP address to websites even though you are connected to a VPN. WebRTC (Web Real-Time Communication) is a browser technology used for video calls, voice chat, and peer-to-peer file sharing. It requires knowing your device's real IP address to function, and it can bypass the VPN tunnel to get it.
This is not a VPN bug -- it is a browser behavior that predates most VPN services. Most modern VPNs include WebRTC leak protection, but not all do it by default.
How to Test for a WebRTC Leak
- Connect to your VPN.
- Go to browserleaks.com/webrtc
- The page will show your public IP address and any local IP addresses detected via WebRTC.
- If your real ISP IP address appears (not the VPN's IP), you have a WebRTC leak.
The local IP address (192.168.x.x or 10.x.x.x) will always appear -- this is your router's internal network address and does not identify you publicly. The concern is if your real public IP appears alongside the VPN IP.
How to Fix a WebRTC Leak
Chrome: WebRTC cannot be fully disabled in Chrome without an extension. Install uBlock Origin (free, open source) -- it has a WebRTC blocking option under Settings > Advanced. Or use a VPN whose Chrome extension explicitly blocks WebRTC (NordVPN, ExpressVPN, and Mullvad browser extensions all do this).
Firefox: Go to about:config in the address bar, search for media.peerconnection.enabled, and set it to false. This disables WebRTC entirely, which may break video calling services like Google Meet and Zoom.
Safari: Safari does not expose the full WebRTC IP stack in the same way as Chrome/Firefox, making it inherently less vulnerable. No additional action is typically needed.
VPN App: Many VPN desktop clients handle WebRTC blocking at the system level, covering all browsers simultaneously. NordVPN, ExpressVPN, and Mullvad desktop clients do this.
Which VPNs Block WebRTC Leaks by Default
VPNs that are confirmed to block WebRTC leaks (desktop and browser extension): NordVPN, ExpressVPN, Mullvad, Surfshark, ProtonVPN. VPNs where you should test rather than assume: any smaller provider or free VPN.
Why This Matters
For casual privacy use, a WebRTC leak is a minor concern. For journalists, activists, or anyone in a country where VPN use is monitored, or anyone trying to hide their location from a specific party, a WebRTC leak can reveal your real location even with a VPN active. The fix takes less than five minutes.