Published September 23, 2026

You open your VPN app, hit the big button, and it turns green. "Connected." Most people stop thinking about it right there, and that's the problem. That green icon only tells you the tunnel is up. It doesn't tell you whether everything you do online is actually going through it.

A VPN can be connected and still leak. When it does, nothing looks broken. Pages load, Netflix plays, your connection feels normal. Meanwhile your ISP can still see the sites you visit, or a website can see your real IP address sitting right next to the VPN one. There are three leaks that cause most of the trouble, and you can check for all of them in about two minutes.

1. DNS Leaks: Your ISP Still Sees Every Site

Every time you type a web address, your device first asks a DNS server to look up the IP address behind it. With a VPN on, that lookup should go through the tunnel to your VPN provider's DNS servers. With a DNS leak, it goes straight to your ISP instead.

Your traffic is still encrypted, but your ISP now has a neat list of every domain you visit: your bank, your doctor's patient portal, that forum you'd rather nobody knew about. And in the US, ISPs have been legally allowed to package and sell browsing history to advertisers since 2017.

The usual causes are pretty mundane. A VPN client that doesn't force DNS through the tunnel, Windows sending DNS queries to several servers at once and using whichever answers first, a browser with its own DNS-over-HTTPS setting, or split tunneling that lets some apps skip the VPN.

How to check: connect your VPN and run the DNS Leak Test. It shows where your DNS resolver is located. If it's in the same place as your VPN server, you're fine. If it shows up in your real location, your DNS is leaking.

2. WebRTC Leaks: Your Browser Gives You Away

WebRTC is the browser technology behind video calls and voice chat on sites like Google Meet and Discord. To connect two people directly, it needs to find out their IP addresses, and it's good at it. Sometimes too good. It can discover your real IP even while your VPN is running and hand it to any website that asks.

This one isn't a network failure at all, it's a browser thing. Chrome, Edge, Opera and Firefox can all leak through WebRTC out of the box. Safari has stricter defaults and generally doesn't, though it isn't completely immune.

How to check: keep the VPN on and open the WebRTC Leak Test. The test runs entirely in your browser. If it shows only your VPN's IP, good. If your real IP shows up next to it, you have a leak.

3. IPv6 Leaks: The Half Your VPN Forgot

Your internet connection probably has two addresses: an older IPv4 one and a newer IPv6 one. Plenty of big US providers, Comcast and Spectrum included, hand out IPv6 to their customers now. The catch is that many VPNs only protect IPv4. Anything that goes out over IPv6 can skip the tunnel entirely and reveal where you really are.

How to check: the IPv6 Leak row in the Security tab on the homepage compares the location of your IPv4 and IPv6 addresses. If they point to different places while your VPN is on, your real location is exposed. You'll find a longer explanation of every possible result on the Security Analysis page, and the IPv6 Test shows your IPv6 address and who owns it.

The 2-Minute Routine

1. Turn the VPN off and open the homepage. Note your real IP, ISP and location, so you know what a leak would look like.
2. Turn the VPN on and pick a server in a different state or country. If the server is in your own city, a leak is much harder to spot.
3. Reload the homepage and open the Security tab. It checks DNS, IPv6 and WebRTC leaks at the same time and shows the results in one place.
4. If anything looks off, open the dedicated DNS or WebRTC test for the details.

Want all of this in one click? The VPN Test runs the DNS, WebRTC and IPv6 checks together and shows your IP address before and after you connect.

Found a Leak? Here's What to Do

DNS leak: look for "DNS leak protection" in your VPN app and make sure it's on. Turn on the kill switch as well, so traffic stops completely if the VPN drops instead of quietly falling back to your ISP. Keep the VPN app updated, since providers regularly fix DNS routing problems on newer Windows and macOS versions.

WebRTC leak: Brave has WebRTC protection built in. In other browsers, uBlock Origin has a setting called "Prevent WebRTC from leaking local IP addresses." Firefox users can also turn WebRTC off completely by setting media.peerconnection.enabled to false in about:config. Just know that switching WebRTC off will break browser-based Google Meet, Zoom and Discord. If you need those for work, a VPN with its own WebRTC protection is the better route.

IPv6 leak: enable IPv6 leak protection in your VPN settings if it has one. If it doesn't, you can disable IPv6 on your device or router while you use the VPN, or switch to a VPN that fully tunnels IPv6.

If your VPN app has none of these settings, the problem isn't your setup, it's the VPN. Cheap and free services are the usual suspects. Every provider in the VPN comparison comes with a built-in kill switch, so that's a good place to start looking for a replacement.

A leaking VPN is in some ways worse than no VPN at all, because you stop being careful. Two minutes of testing tells you whether the thing you're paying for is actually doing its job.