WebRTC leak test: what a browser call reveals about your IP address

What is a WebRTC leak?

Before a WebRTC call, the browser collects possible network routes, called ICE candidates, and hands them to the web page to pass to the other side. Each carries an IP address, or a random .local name in place of a hidden local one. An ordinary website sees only the public address your request came from; through WebRTC a page can learn more ^[1]. A leak is any address in that list you did not mean to share.

How the rest of a call travels is in WebRTC, SIP and the phone network; for leaks, only the candidate list matters. MDN notes its addresses are always exposed to the page ^[6].

The IETF calls the VPN case the most significant, because some people use a VPN to stay anonymous ^[1]. The other two cases are your private address and a proxy that WebRTC's checks bypass, which reveals your real public address ^[1].

Does a browser call expose your IP address?

To the calling service, yes: every website sees your public address ^[1], and a call adds a media connection to the service's servers. To someone you call on a landline or mobile, no: the call leaves the internet at the provider's gateway ^[8], and the phone network passes on a calling number, not an IP address ^[2]. App-to-app calls can connect two devices directly.

For calls to real numbers, the question is what the service learns and keeps; what the person you ring sees instead is in which number appears when you call from a browser.

How to run a WebRTC leak test

A leak test page does what a dialer does before a call: it opens a WebRTC connection, asks a STUN server which public address it sees, and prints every candidate next to the address it sees over plain HTTP. Run it in each browser you call from, first with your VPN off and then with it on.

1. VPN off: open a leak test page, such as BrowserLeaks' WebRTC Leak Test. "Your Remote IP" at the top and "Public IP Address" under "Your WebRTC IP" should match.
2. VPN on: reload. "Your Remote IP" should now show the VPN's address.
3. If the WebRTC section still lists your provider's address, WebRTC is going around the tunnel ^[1].
4. A local entry ending in .local means the address is hidden ^[3]; a raw one starting with 192.168. or 10. is not.
5. If the page offers a microphone check, allow it and test again: a dialer needs microphone access, and that permission can unlock more addresses ^[1]. Remove the permission afterwards in site settings ^[12].

What changed in Chrome once the microphone was allowed

On November 1, 2026 I loaded a local test page in Chrome 156 on a Mac, with no STUN server, so no address went to an outside server. Without microphone permission, the page saw one host candidate named with a random string ending in .local ^[3]. With the microphone allowed, it received my real local IPv4 address.

That follows the standard, which allows the full address list only with consent, such as microphone permission ^[1]; WebKit, Safari's engine, described the same rule in 2017 ^[13]. So a dialer you allow can see your local address: a smaller risk than your public one ^[1].

Browser settings that limit WebRTC leaks

Brave documents a WebRTC IP setting for users. Google documents Chrome's controls for extensions and administrators, and Microsoft documents Edge's as an administrator policy. Firefox hides local addresses by default and keeps an off switch in about:config. One rule holds everywhere: switching WebRTC off also stops browser dialers, because WebRTC carries the call ^[14].

What a VPN changes for browser calls

A VPN that sends all traffic through its tunnel, WebRTC included, shows the calling service the VPN's address instead of yours. A split-tunnel VPN may also let WebRTC find your provider's address ^[1], hence the leak test with the VPN on. A VPN has side effects on calling, too.

• Some services restrict VPNs: TextNow's terms say it may limit or restrict their use ^[21].
• Some free dialers ration free calls by IP address, as Call2Friends does ^[9], so on a VPN you may share that allowance with other users of the same exit address.
• Forcing media through a proxy that cannot carry UDP moves audio onto TCP, which the IETF says reduces media quality ^[1].
• The service still sees your account and call records; Google, for one, may log the numbers, time and duration of calls ^[22].

How to keep your IP address private on calls

Match the fix to the call. On calls to phone numbers, the person you ring doesn't get your IP, so pick a service you trust with it and check your VPN. On app-to-app calls, the other device may connect to yours directly, so use the app's relay setting where there is one.

1. Browser calls: run the leak test with the VPN on; in Brave, choose Default Public Interface Only ^[15].
2. Microphone: on dialers you use once, grant it with "Allow this time" ^[12]; in my Chrome check, a page holding that permission could see the local address.
3. WhatsApp: turn on Protect IP address in calls. The help page covers Android, iOS and Mac, not the web, and warns that relayed calls may lose some quality ^[5].

Frequently asked questions

Related reading

• Explainers

  VoIP caller ID: which number people see when you call from a browser

  VoIP caller ID on a browser call can be a shared number, a number from the service or your verified mobile. I compare what each shows and who can call back.

• Guides

  Calling 911 from a computer: what works, what is blocked and what to use instead

  Can you call 911 from a computer? I checked which browser and VoIP services connect 911, 112 or 999, what the rules require, and what to use instead.

• Explainers

  5-minute and 1-minute free calls: what trial minutes really give you

  A 5 minute free call is usually a 2–3 minute daily allowance or a one-off trial. I checked which free trial calls online still exist, their limits and catches.