IP Leak Test
Check whether your browser shows an IP address your proxy or VPN should hide.
ColdProxy keeps no logs of this test's IP-lookup requests and does not save its results. ColdProxy's lookup servers see your web IP. Cloudflare's STUN server gets your WebRTC IPs under its own policy; they can differ from the IP websites see, such as one your proxy or VPN hides. The DNS check contacts bash.ws, an outside service that receives your web IP and the run's DNS servers and keeps them 3 days (bash.ws privacy policy (opens in a new tab)). Site analytics follow your cookie settings.
This tool checks public IPv4, IPv6, addresses exposed through WebRTC, and the DNS servers that look up names for your browser.
An IP leak test checks whether your browser reveals an IP address you meant to hide. This one looks up the public IPv4 and IPv6 addresses your web traffic uses, collects the addresses WebRTC exposes, finds the DNS servers that look up names for your browser, compares them and gives one plain result. It is free and needs no signup.
Your IP leak test result
Ready to test
Press Start test. Your result appears here within 10 seconds.
Optional before-and-after comparison: run the test once with your VPN or proxy off, tick Taken with my VPN or proxy off and save that connection. Then turn your VPN or proxy on, tick My VPN or proxy is on now, next to Run again at the top of the test, and run the test again. The run with it off sends your direct address to ColdProxy's lookup servers and Cloudflare's STUN server, and lets bash.ws see your direct address and the DNS servers that look up the test names, so skip this step if you prefer. DNS server addresses can reveal your internet provider, or your own address if you run your own DNS resolver, even when your proxy or VPN hides it.
How to read your result
The test runs four checks: a web lookup of your public IPv4 address, a web lookup of your public IPv6 address, the addresses WebRTC exposes, and the DNS servers that look up names for your browser. One label sums them up, and the cells under it show whether each check was complete, timed out, unavailable or inconclusive. The DNS check covers this browser's lookups only; other apps on your device can use different DNS.
Leak found: your saved IP is visible
The address you saved with your VPN or proxy off showed up again after you confirmed it is on. The finding says whether the web lookup or WebRTC exposed it.
Saved IP still visible
The same exact match without both boxes ticked: Taken with my VPN or proxy off when you saved, and My VPN or proxy is on now when you ran again. The finding says how to confirm it, or why it can be harmless, as with a sticky proxy session that keeps its exit IP.
Possible WebRTC leak
WebRTC exposed a public IP different from the one your web traffic uses. With a proxy or VPN, that can be the address you meant to hide; a rotating proxy or some network setups can also explain it.
Check this
A difference worth a look, named in the finding: for example, your IPv4 and IPv6 traffic leave through different networks, your DNS servers belong to a different network from your web traffic, or WebRTC exposed an IPv6 address the web lookup could not see.
Test incomplete
A check could not finish or had nothing to compare, and none of the checks that finished found a difference. On a connection, proxy or VPN that carries only IPv4 or only IPv6, or with WebRTC limited to the proxy, this is the best result the test can give. If only the DNS check could not finish, a blocker may have stopped it: pause the blocker for this page and run the test again. Each check is explained with what to try next.
No unexpected public IPs found
Every check finished: each public IP WebRTC exposed matches the web lookup, and the DNS servers use the same network as your web traffic. It covers this browser, the requests the test made and this run, not other apps.
How to fix what the test finds
The test points to one of four causes: WebRTC that goes around your proxy or VPN, IPv6 traffic that a VPN or system-wide setting does not carry, DNS lookups that do not go where you meant them to, or a proxy that is on for another app or browser profile but not this one. Fix the one your finding names, one setting at a time, then press Run again.
How to fix a WebRTC leak
Setting a proxy in your browser does not by itself make WebRTC use it: WebRTC routing also depends on the browser's policy and on the transports the proxy supports. In your browser's privacy or WebRTC settings, limit WebRTC to the proxied connection or turn off non-proxied UDP, where the browser offers it, and test again. When the fix works, WebRTC shows the same public IP as the web lookup or no public address at all; with none, the result reads Test incomplete, which is expected here.
In an anti-detect browser, set each profile's WebRTC option to follow the proxy's exit IP; the anti-detect browser setup guide shows how to add the proxy to a profile so settings derived from the exit IP, such as WebRTC, match it. A substituted WebRTC address changes what sites see, not how your traffic is routed.
How to fix an IPv6 leak
If the web IPv6 lookup shows Unavailable on a connection, proxy or VPN without IPv6, that is expected and needs no fix. An IPv6 leak happens when a VPN or system-wide setting carries only IPv4 and leaves IPv6 traffic on your own connection; a proxy set in the browser carries the browser's web requests itself. Configure IPv6 routing rather than switching IPv6 off everywhere: use a VPN setup that carries IPv6 too, or set the proxy in the browser or app you test.
ColdProxy's IPv6 proxies, Residential IPv6 (USA) and Datacenter IPv6, serve targets on IPv6 or a supported CDN; the IPv6 reachability guide explains which sites they reach. If a target supports only IPv4, an IPv4 route is the one that works.
How to check your DNS settings
A DNS server on a different network from your web traffic, or on your saved connection's network, is a reason to check where your lookups go. A network match or difference alone proves neither how your traffic is routed nor a DNS leak. Compare the servers with the DNS your proxy, VPN or browser is meant to use.
With a proxy, names are looked up at the proxy when it resolves them: HTTP proxies, and SOCKS5 proxies in Chrome, resolve at the proxy, while Chrome looks up SOCKS4 names on your device. In Firefox, turn on Proxy DNS when using SOCKS v5, as the Firefox setup guide shows; in curl, use
socks5h://rather thansocks5://. Without a proxy that resolves names, your browser's secure DNS (DNS over HTTPS) setting decides which servers look them up, and with it on the test shows that provider's servers. With a VPN, check its DNS setting, so lookups use the VPN's own DNS servers.The saved IP still shows up
Check that the proxy or VPN is on for this browser, not only for another app, and that the browser profile you tested is the one that uses it. Then read which part exposed the saved address: the web lookup points to the browser's proxy settings, WebRTC to the WebRTC settings above, and IPv6 to the IPv6 routing above. The proxy verification guide walks through the checks.
Keep your real IP private on the traffic you proxy
Route your browser profiles, scrapers and QA runs through ColdProxy, and the sites they visit see a proxy IP in the country you pick instead of yours, with no traffic logs. WebRTC also follows your browser's settings, so set it as shown above and run this test again in the same profile once the proxy is on. Keep one IP for a sticky session or rotate on every request, with unlimited traffic on the speed-based plans or a monthly GB pack.
- Residential IPv4 in 195+ countries, with state and city targeting where available
- Residential IPv6 in the USA and Datacenter IPv6 in 45+ locations, for sites on IPv6 or a supported CDN
- 99.9% network success rate, 24/7 support
- Test from one hour on hourly plans
IP leak test FAQ
Yes. The IP Leak Test is free, needs no signup or login, and runs in your browser. Run it as often as you like, for example once with your proxy or VPN off and once with it on.
It checks four things: the public IPv4 address and the public IPv6 address your web traffic uses, looked up through ColdProxy's own servers with their network and approximate location, the addresses your browser exposes through WebRTC, and the DNS servers that look up names for your browser, with their network. It compares them and gives one plain result, with each finding explained.
Start with the label at the top. Leak found: your saved IP is visible means the IP you saved with your proxy or VPN off showed up again after you confirmed it is on; Saved IP still visible is the same match without both boxes ticked. Possible WebRTC leak means WebRTC showed a public IP different from the one your web traffic uses. Check this means a difference worth a look, such as IPv4 and IPv6 leaving through different networks, or DNS servers on a different network from your web traffic. Test incomplete means a check could not finish or had nothing to compare. No unexpected public IPs found means every check finished and matched. The cells under the label show how complete each check was.
No. ColdProxy keeps no logs of this test's IP-lookup requests and does not save its results. Two outside services are separate recipients. Cloudflare's STUN server, which the WebRTC check contacts, receives the IP addresses your browser uses for WebRTC under Cloudflare's own policy. bash.ws, which the DNS check contacts, receives your web IP and the DNS server addresses seen during the run, and bash.ws says it keeps them 3 days. DNS server addresses can reveal your internet provider, or your own address if you run your own DNS resolver, even when your proxy or VPN hides it. Site analytics follow your cookie settings.
An IP leak is when a website or service can see an IP address you meant to hide behind a proxy or VPN. In a browser it usually happens through WebRTC, or through IPv6 traffic that takes a different route than your IPv4 traffic.
A WebRTC leak is when the browser's real-time communication feature reveals a public IP address different from the one your web requests use. WebRTC can reach servers directly, so a proxy set only for web traffic may not carry it, depending on the browser and its settings.
An IPv6 leak is when a VPN or system-wide setting carries only IPv4, so sites that support IPv6 see your own IPv6 address. A proxy set in the browser carries the browser's web requests itself, so there WebRTC is the path to check. This test marks two signs of one as Check this: your IPv4 and IPv6 traffic leaving through different networks, or WebRTC exposing an IPv6 address the web lookup could not see. Treat them as signals to look into, since some proxies also use different networks for their IPv4 and IPv6 exits.
Yes. A DNS leak is when the names you visit are looked up by DNS servers outside your proxy or VPN, such as your internet provider's. The DNS check makes your browser look up ten one-time test names under bash.ws, an outside DNS-leak service, then reads back which DNS servers asked for them, with each server's network and country, and compares those networks with your web traffic's. The result names each server's network, so you can see whether one belongs to your internet provider; saving a connection with your VPN or proxy off first lets the test compare for you. bash.ws receives your web IP and those DNS server addresses, and bash.ws says it keeps them 3 days. The check covers this browser's lookups only: other apps on your device can use different DNS, and your browser's secure DNS and proxy settings change which servers it shows. To resolve names at the proxy, turn on Proxy DNS when using SOCKS v5 in Firefox, as the Firefox setup guide shows, or use remote DNS (socks5h://) through ColdProxy's SOCKS5 gateway in SOCKS5 clients that support it, such as curl, as the SOCKS5 examples show.
Because a check could not finish or had nothing to compare: a lookup timed out, your connection or proxy carries only IPv4 or only IPv6, your browser blocked, limited or masked WebRTC, WebRTC got no IPv4 reply from the STUN server, or the DNS check was blocked, timed out or found no DNS servers. On a connection or proxy that carries only one of IPv4 and IPv6, or after you limit WebRTC as the fix steps suggest, Test incomplete is the best result the test can give. The result explains each check and what to try next.
No, a clean result covers only this browser in this run; cookies, logins and browser fingerprints can still identify you. For other apps to use the same proxy, set it up in each app or for the whole system, as our guide to setting up a proxy on any device shows.
No. The saved connection lives only in this page's memory and is gone when you reload or leave the page. It is never written to cookies, browser storage or the page address. To compare again later, run the test and save a new connection.