WebRTC and IP leaks
Why it matters If you use a VPN to hide your IP address, there is one browser feature that has a history of quietly working around it. Knowing about it lets you check that your protection really covers everything.
Picture two people who want to talk on the phone, but each only knows the other's office switchboard. To connect directly, they each ask a helper "what number do I look like from the outside?" and swap the answers. Video calls in the browser do something very similar.
WebRTC: Web Real-Time Communication: the browser feature that lets pages make video calls, voice calls and file transfers directly between two devices, without sending everything through a server.
STUN server: a helper server that tells your browser what IP address it appears to have from the outside. Your browser asks; the STUN server replies with the address it saw.
Local IP address: the address your device has inside your home or office network, such as 192.168.1.23. It is different from the public address websites see.
Why it could leak
To connect two people directly, WebRTC gathers every address that might work and shares them with the page. In the past that included your local address, and a page could read it with a few lines of script, even if you never started a call. A local address helps tell apart devices that share one public address, so it was useful to trackers.
What browsers do now
Modern browsers hide your local address behind a random name such as 3f2a9c1e-7b4d.local, using a system called mDNS. The other device on your own network can still find you with that name, but a web page only sees the random label (checked October 2026).
mDNS: multicast DNS: a way for devices on the same local network to find each other by name. Browsers use it so pages see a throwaway name instead of your real local address.
Your public address is a different story. A page can still ask a STUN server what your public address is, because a call needs it to work (checked October 2026). Normally that is the same address the website already sees, so nothing new leaks.
One more detail: once you allow a page to use your camera or microphone, some browsers do let it see your real local address, because a call on your own network may need it (checked October 2026). So only give those permissions to sites you trust.
Where VPN users should look
The problem appears when the call traffic takes a different path from your normal browsing. If a VPN only covers some traffic, or a browser setting lets WebRTC use your real connection, a STUN request could reveal the public address your VPN was meant to hide.
Most well-made VPN apps now route all traffic, including WebRTC, through the VPN. Some browsers and extensions also offer a setting to limit which addresses WebRTC may use. The point is to check, not to assume.
A common misconception
"WebRTC only runs when I am on a call." A page can start the address-gathering step without showing any call screen. That is why the mDNS change mattered: it protects you even on pages that never ask to use your camera.
Try it
If you use a VPN: switch it on, then search for a "WebRTC leak test" from a privacy organisation you trust and compare the public address it reports with the address your VPN app shows. If the test shows a different address from your VPN's, check your VPN's settings for an option to protect all traffic.
Recap
- WebRTC lets pages make direct calls, and gathers your addresses to do it.
- Browsers now hide your local address behind a random mDNS name.
- Your public address can still be learned through a STUN server.
- If you rely on a VPN, check that it also covers WebRTC traffic.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.