VPN Leak Test

About the VPN Leak Test

A VPN should carry all of your browser’s traffic. A leak is anything that still goes out through your own internet provider: IPv6 traffic the VPN does not tunnel, WebRTC (the technology behind video calls) asking a public server for your address over UDP, or a browser extension or split-tunnelling rule that sends some sites another way. Any of them shows websites your real network — and it takes them only a few lines of script.

This test looks at your connection the way websites do. It finds your IPv4 and IPv6 exit addresses, the public address WebRTC reveals, and the address MySmartCoPilot’s server sees, puts each one in its network (the AS that routes it), and compares them: if they leave through different networks, something leaks. It also checks whether the exit is a data centre or an internet provider, whether it is a Tor exit, and whether your browser’s time zone and languages fit the exit’s location — the clues sites use to spot VPN users. Each row says OK, Check, Leak or Info, with what was found and how to fix it.

Common uses

• Checking a new VPN, a new VPN server or a VPN app update before you rely on it.
• Finding out why a streaming or banking site still sees your home country with the VPN on.
• Confirming that a corporate or school VPN carries IPv6 and WebRTC traffic too.
• Collecting a clear report for your VPN provider’s support team.

What each check looks at

• IPv6 leak: your IPv4 and IPv6 exits must leave through the same network. Many VPNs tunnel only IPv4; then IPv6 goes straight out through your provider.
• Different routes for different sites: MySmartCoPilot’s server and the address check should see the same network. If not, split tunnelling, a proxy setting or an extension sends part of your traffic another way.
• WebRTC leak: the page asks a public STUN server (Google’s) for its view of your address over UDP, as video-call sites do, and compares it with your exits.
• Local address: whether WebRTC shows your device’s local address (such as 192.168.1.20) or hides it behind a random “.local” name.
• Exit network (heuristic): a data centre, a content-delivery network or an internet provider, from the networks the site knows, cloud providers’ published IP ranges and the network’s registered name.
• Time zone and languages (heuristic): your browser’s settings against the location of your exit address.
• Tor: whether the exit is a Tor exit relay in the Tor Project’s relay list.

WebRTC and your addresses

Browsers follow RFC 8828: without your consent, WebRTC may only use the route your web traffic takes (the “default route”) and may show the local address of that interface. Current browsers also hide that local address — usually behind a random .local name (mDNS) — unless a page has camera or microphone permission. A WebRTC leak therefore usually means the VPN does not catch UDP traffic, or it lets some interfaces bypass the tunnel. A trusted VPN app’s WebRTC or leak protection fixes it for every browser; the fix row also names the browser setting.

Heuristics, not certainty

Addresses are compared by network — the AS (autonomous system) that announces them on the internet — using the IPtoASN routing snapshot (public domain, PDDL v1.0) that ships with the site; two addresses of one AS count as the same network. Whether a network is a data centre or an internet provider is a heuristic: known cloud, hosting and CDN networks, the published IP ranges of large cloud providers, and words in the network’s registered name. Some VPNs rent home-broadband addresses (“residential” exits), which look like an internet provider, and a network’s name can be misleading — so these rows are labelled heuristic and never decide on their own that something leaks.

The same judgement separates a leak from a VPN with two providers: when IPv4 and IPv6 (or WebRTC) leave through two different networks, that is a Leak — unless both look like data-centre networks. Then the row says Check instead, because a leak shows your home or mobile provider, while two hosted networks usually belong to the VPN. A baseline run without the VPN reports such differences as information only.

Limitations

• It tests this browser only. Other apps can bypass the VPN differently, for example with per-app split tunnelling.
• DNS leaks are not tested: a web page cannot see which DNS resolver your device asks, and testing it needs a DNS server that records the resolvers looking up one-time names, which this site does not run. Use your VPN provider’s DNS leak test.
• Network names come from a routing snapshot, so a block of addresses that recently moved to another network can show its earlier owner.
• If a content blocker stops icanhazip.com, ipify.org or the STUN server, those checks find fewer addresses; the rows then say what is missing.
• MySmartCoPilot’s server allows a limited number of these tests per hour for each visitor.

Privacy

The test runs only when you press the button, and its results stay in your browser. Your browser asks MySmartCoPilot’s server how it sees your connection (address, approximate location, time zone and network — nothing is stored or logged); asks icanhazip.com, or ipify.org if that fails, for your IPv4 and IPv6 addresses; sends a STUN request to Google’s public STUN server (stun.l.google.com), as any video-call site does; and asks the Tor Project’s Onionoo service whether your exit address is a Tor relay. Each of them sees your IP address, like any site you visit. Network names are looked up in data files downloaded from MySmartCoPilot, so your addresses are not sent anywhere for that.