Free tool
Is your VPN really hiding you? This page checks the four ways a real address slips out, in your browser, in a few seconds.
Connection check
Checking…
Teal VPN keeps your real address private. Pro from $3 a month, 30‑day money‑back.Get Teal VPN
Teal VPN
Checking…
Public IP address
…
IPv6
Checking…
WebRTC
Checking…
DNS servers
Checking…
Read in your browser and shown back to you. Nothing is stored. What Teal VPN keeps.
Built not to leak
Run this test with Teal on and every line should say the VPN side. Free with 500 MB every day, no card.
Browsers can open direct connections for calls and video. To do that they collect the addresses they can be reached on and may hand them to a page’s script. A page can read your public address from that list even with a VPN on, if the VPN does not cover the browser. A whole-device VPN app closes this; a browser extension cannot.
Many connections have an IPv6 address next to the IPv4 one. A VPN that carries only IPv4 and leaves the IPv6 route open lets IPv6 traffic go around the tunnel, carrying your real IPv6 address. The right fix is to carry IPv6 inside the tunnel or to add no IPv6 route at all, which is what Teal does when the server has none.
If name lookups still go to your provider’s resolver while the VPN is on, the provider sees every site name you open, even though the traffic itself is hidden. A VPN has to send DNS inside the tunnel to its own resolver. Teal’s apps do, and the DNS row above shows which resolver asked for this page’s test names.
Use a VPN app that routes the whole device, not a browser extension, so WebRTC and every other app go through the tunnel. In Firefox, media.peerconnection.enabled can be switched off; in Chrome an extension can limit WebRTC. Make sure the VPN either carries IPv6 or blocks it, and that DNS goes through the tunnel. Teal VPN does all three by design. Get Teal VPN
Your real public address reaching a website while a VPN is on. It happens through WebRTC in the browser, through IPv6 when the VPN only carries IPv4, or through DNS lookups that go around the tunnel. Each one tells the site where you really are.
The page reads the address Cloudflare already sees on this request and asks the browser for its WebRTC candidates; nothing is stored. The Teal VPN on/off check asks our API one yes-or-no question and keeps nothing.
The apps route every app through the tunnel, send DNS through the tunnel, and add no IPv6 route when the server has none, so IPv6 cannot slip out. If this page shows your real address with Teal VPN on, write to support with the screenshot; that is a bug we want.
Location databases map an address to the place the provider registered it, often a hub city. Mobile networks are frequently shown in another city. It is not a leak.
Older browsers exposed local addresses through WebRTC; current Chrome, Firefox and Safari hide them behind a random name, so the test usually shows none. A public address in the WebRTC list while a VPN is on is the one that matters.
Teal VPN Updated