VPN Leak Test Explained: How to Check if Your VPN is Actually Working

Why You Need to Test Your VPN

A VPN creates an encrypted tunnel between your device and a server, masking your real IP address and encrypting your traffic. But "creating a tunnel" and "routing all traffic through it" are not the same thing. Several common scenarios can cause traffic to leak outside the VPN tunnel, exposing your real IP address, DNS queries, or other identifying information.

A 2026 study of the top 20 consumer VPN services found that 35% had at least one type of leak in their default configuration. This doesn't necessarily mean the VPN is insecure — it often means a specific setting needs to be enabled or a browser feature needs to be disabled. But if you never test, you'll never know.

The Three Essential Leak Tests

Test 1: IP Address Leak

This is the most basic test. When connected to a VPN, your visible IP address should be the VPN server's IP, not your real one.

How to test:First, disconnect your VPN and note your real IP address (use our tool or simply search "what is my IP" on Google). Then connect to your VPN and check again. The IP should be different — it should show the VPN server's location, not yours. If you see your real IP while connected to the VPN, your VPN connection has failed or is misconfigured.

Common causes of IP leaks: The VPN connection dropped without activating a kill switch. Split tunneling is enabled and your browser is excluded from the VPN tunnel. IPv6 traffic is not being routed through the VPN (your device is connecting via IPv6 which bypasses the IPv4 VPN tunnel).

How to fix:Enable the kill switch in your VPN settings (this blocks all internet access if the VPN disconnects). Disable split tunneling unless you specifically need it. Disable IPv6 in your operating system's network settings if your VPN doesn't support it.

Test 2: DNS Leak

Even if your IP is masked, DNS leaks can reveal every website you visit. A DNS leak occurs when your DNS queries (the requests that translate domain names like "google.com" into IP addresses) are sent to your ISP's DNS servers instead of through the VPN.

How to test:With your VPN connected, run a DNS leak test. The test sends multiple DNS queries and records which DNS servers respond. If you see your ISP's DNS servers (rather than your VPN provider's), you have a DNS leak.

Common causes:Windows "smart multi-homed name resolution" queries all available DNS servers simultaneously, including your ISP's. Your VPN client doesn't override system DNS settings. You've manually configured DNS servers (like Google's 8.8.8.8) that aren't routed through the VPN. Your router has hardcoded DNS settings that override your device's VPN configuration.

How to fix:Use your VPN's built-in DNS servers (most reputable VPNs run their own). On Windows, disable smart multi-homed name resolution via Group Policy or registry. Remove any manually configured DNS servers when using a VPN. Enable DNS leak protection in your VPN client settings.

Test 3: WebRTC Leak

WebRTC is the most dangerous leak vector because it bypasses VPNs entirely at the browser level. WebRTC uses STUN servers to discover your device's IP addresses for peer-to-peer connections, and this discovery process ignores the VPN tunnel.

How to test:With your VPN connected, run our WebRTC leak test. If the test shows any IP address other than your VPN server's IP, you have a WebRTC leak. Pay special attention to local IPs (192.168.x.x or 10.x.x.x) which reveal your network configuration.

How to fix: In Firefox, type about:config in the address bar and set media.peerconnection.enabled to false. In Chrome or Edge, install the WebRTC Leak Shield extension, or use your VPN's browser extension if it includes WebRTC protection. Brave Browser has built-in WebRTC leak protection that's enabled by default.

Step-by-Step: Complete VPN Verification

Here's the full procedure for testing your VPN setup:

1. Baseline test (VPN off): Run PrivacyCheck with your VPN disconnected. Note your real IP, DNS servers, and WebRTC status. This is your "before" snapshot.
2. Connect your VPN: Connect to your preferred server location. Wait 10 seconds for the connection to stabilize.
3. Protected test (VPN on): Run PrivacyCheck again. Compare every result with your baseline.
4. Verify IP changed:Your visible IP should now be the VPN server's IP in the VPN's stated location.
5. Verify DNS protection:DNS servers should show your VPN provider's DNS, not your ISP's.
6. Verify WebRTC protection: No local or public IPs should be leaked through WebRTC.
7. Check timezone consistency: If your VPN claims to be in London but your timezone shows America/New_York, you have a mismatch that reveals VPN usage.

What to Do if You Find a Leak

Finding a leak doesn't mean you need to switch VPN providers. Most leaks are caused by configuration issues, not fundamental VPN failures. Start by checking your VPN client's settings for kill switch, DNS leak protection, and IPv6 leak protection options. These three settings resolve the majority of leak issues.

If leaks persist after enabling all protection settings, contact your VPN's support team with the specific test results. A good VPN provider will help you troubleshoot. If they can't resolve the issue, then it's time to consider switching.

For WebRTC leaks specifically, the fix is always at the browser level — no VPN can prevent WebRTC from discovering your real IP. This is a browser design decision that you need to override with settings changes or extensions.

How Often Should You Test?

Test your VPN after initial setup, after any VPN client update, after operating system updates (which can reset network settings), after changing VPN servers, after switching networks (home to office to public Wi-Fi), and periodically (once a month) as a routine check.

Bookmark PrivacyCheck for quick access. A 30-second test once a month is cheap insurance for your privacy.