Popular tools

Theme

VPN Test

One run checks the address websites see, WebRTC and your other address family, with DNS on request, then says whether your VPN works and what leaks.

Runs in your browser · nothing is stored · network rules published on What Is My ISP

Checks the address websites see, WebRTC and your other address family. DNS runs when you ask: it uses our test nameserver.

The four checks

  1. AddressThe network every website sees

    Waiting

  2. DNSWho looks up the names you visit

    Waiting
    Runs on its button: it asks our test nameserver, which every visitor shares. DNS Leak Test

  3. WebRTCThe addresses your browser hands a page

    Waiting

  4. IPv6Your other address family

    Waiting

Nothing this test finds is stored. To show what websites see, the page asks ipify.org and our own server for your addresses and their networks; WebRTC runs in your browser. DNS asks our test nameserver only when you press Check DNS too.

How do I test my VPN?

Run the test above with your VPN on. It reads the address every website sees, asks WebRTC what it would hand a page, checks your other address family and, when you ask, your DNS, then puts the four answers into one verdict.

Each check is a different way your traffic can go around a tunnel, and they fail independently. The address says whether a VPN is on at all. DNS says who looks up the names you visit: your provider's DNS server while the VPN is on is a leak, because it shows your provider every name you look up, and that you're hiding your location. WebRTC can hand a page the addresses of every network connection, the one under the VPN included. Your other address family matters when a VPN carries only IPv4: IPv6 then goes out through your provider.

A check that can't run says so, and it never counts as no leak. Run the test once with the VPN off and once with it on: the first run shows your own provider, and the second should show none of it.

The four checkseach fails on its own

The four checks
CheckWhat it asksA leak meansGo deeper
AddressWhich network every website seesNo VPN: websites see your providerWhat Is My ISP
DNSWho looks up the names you visitYour provider sees every name you look upDNS Leak Test
WebRTCWhich addresses your browser hands a pageA page's script gets an address you were hidingWebRTC Leak Test
IPv6Whether your other address family uses the tunnelSites reached over IPv6 see your providerIPv6 Test
A clean result on one check says nothing about the other three, so the verdict waits for all four. A check that couldn't run is said, never counted as clean.
VPN test result: the verdict, the four checks with their states, and what websites see from the connectionVPN test result: the verdict, the four checks with their states, and what websites see from the connectionThe verdictOn, off, or on with leaks, each leak named. A check that couldn't run is said, never read as no leak.Each checkThe address websites see, DNS, WebRTC and your other address family, each with what it found.Its stateLeaks, no leak, couldn't check, or not checked yet: DNS runs only when you press its button.What websites seeEach address and its network. A hosting network looks like a VPN; your own provider's name means no tunnel.The time-zone tellYour browser's clock against your address's zone. A site can notice a mismatch, but it isn't a leak.
An example run on made-up addresses, with a VPN that carries only IPv4: the verdict names each leak, every check shows what it found, and the column shows what websites see. Select a number to see what each part shows.

Is my VPN on or off?

Look at the network websites see. Most VPN exits are in data centres, so with a VPN on the address belongs to a hosting company; without one it belongs to your home or mobile provider.

The test names the network from the address's AS number with the same published rules as What Is My ISP: a list of cloud, hosting and VPN-infrastructure networks, none of them a home provider; Apple's Private Relay partners and Cloudflare; and the Tor Project's own list of exit addresses. It's a reading of the network, never of you: a work network or a cloud desktop can look like a VPN too.

Websites can tell the same way. Detection companies sell lists of such addresses: MaxMind describes flagging "IP addresses associated with hosting services that are likely to be used as anonymizers", VPN services included. Their lists are their own; ours are the published rules above. A clock in another time zone than your address is a second tell.

What the address saysby our published rules

What the address says
Websites seeHow we knowThe test says
A cloud, hosting or VPN-infrastructure networkOn our hosting list: none of them is a home providerVPN on
An iCloud Private Relay partnerThe networks behind Apple's published relay addressesAS36183 · AS13335 · AS54113Relay
CloudflareWARP and Private Relay both leave through itAS13335Relay
A Tor exitOn the Tor Project's own list of exit addressesTor
A home, mobile or satellite providerAny other network websites seeNo VPN
A reading of the network, never of you: an office or a cloud desktop looks like a VPN too. Detection companies keep their own, private lists.

How can I test my VPN location?

Read the place under What websites see: it's where address databases put your VPN's exit. Then compare the two time zones under it.

The place comes from the address. Location databases are nearly always right about the country and often wrong about the city. Some VPN locations are also virtual: Proton VPN, for one, offers countries whose servers "are, in reality, located elsewhere". The countries of DNS servers say nothing about where you are, because public DNS answers from many places at once.

The first time zone is Cloudflare's for your address; the second is the one your browser tells any page that asks. When they differ, a site can notice that your clock and your address disagree. That's a tell, not a leak: it gives away no address. Change your device's time zone only if that matters to you.

Two clocksan example

From your addressEurope/BerlinUTC+01:00Cloudflare's time zone for the address
Your browser's clockAsia/KolkataUTC+05:30What JavaScript tells any page

A site can notice they disagreeA tell, not a leak: no address is given away

The first clock follows the VPN's exit; the second stays wherever your device is set. Compare them under What websites see.

Why is my VPN not working?

If the test says no VPN is on while your app says connected, this browser's traffic isn't going through the tunnel. Usually the VPN dropped, it doesn't come back on by itself, or the app leaves this browser out.

Start with the system's own setting. Android can start a VPN at boot and keep it on (always-on VPN, Android 7.0 and later), and block every connection that doesn't use it. iPhone, iPad and Mac can connect a VPN on demand. Windows lists VPN connections under Settings › Network & internet › VPN, with Connected under the name of the one that's up.

Then check the app. Many VPN apps can send only some apps through the tunnel, often called split tunnelling; on Android an app's allowed and disallowed lists decide it. If your browser is left out, websites see your provider. On Apple devices a little system traffic always stays outside a VPN app's tunnel, such as what keeps the device on the local network and Wi-Fi sign-in pages. With WireGuard and OpenVPN, the tunnel's DNS and the block on DNS outside it come from lines in the config.

Where to look

Settings › Network & internet › VPN › ⚙ next to your VPN › Always-on VPN, then Block connections without VPN

Always-on VPN starts the VPN at boot (Android 7.0 and later); Block connections without VPN stops everything that doesn't use it. Android's help says a VPN set up through an app won't show the always-on option here.

What each leak means, and how to fix it

A DNS leak shows your provider the sites you look up, a WebRTC leak hands a page an address you were hiding, and an IPv6 leak sends a whole address family past the tunnel. Each has its own fix.

DNS: once connected, use only the DNS servers your VPN gives you. VPN apps keep DNS inside the tunnel with firewall rules, and a custom DNS set in your system can override that, as can your browser's own secure DNS setting. WebRTC: Firefox has preferences that restrict it, Edge has a policy and Safari restricts it already; the WebRTC Leak Test has each browser's steps.

IPv6: turn on your VPN app's IPv6 leak protection, or use a VPN that carries IPv6 too. Switching IPv6 off is an operating-system last resort: Microsoft doesn't recommend disabling it on Windows. The time zone is a tell, not a leak, so there's nothing to fix unless it matters to you.

Each leak and its fixand the test that checks it

Each leak and its fix
LeakWhat it gives awayFixCheck with
DNSEvery name you look up, to your providerUse only your VPN's DNS. Remove a custom DNS from your system and the browser's own secure DNS, which can override the VPN's.DNS Leak Test
WebRTCAn address you were hiding, to any page that asksFirefox: its WebRTC preferences. Edge: its policy. Safari restricts it already.WebRTC Leak Test
IPv6Your provider's IPv6 address, to sites reached over IPv6Turn on the VPN app's IPv6 leak protection, or use a VPN that carries IPv6. Switching IPv6 off is a last resort.IPv6 Test
Time zone · A tellOnly that your clock and your address disagreeNothing leaks. Change your device's time zone only if it matters to you.—
Fix one at a time and run the test again after each change: they fail independently.

What does a VPN kill switch do?

A kill switch blocks your connection when the VPN drops, so nothing goes out through your provider until it reconnects. Without one, your traffic and your DNS fall back to your normal connection.

VPN apps describe it the same way. Proton's "protects your IP address and DNS activity by blocking all internet traffic on your device if your VPN connection drops", and its standard kill switch acts only when the connection drops by accident, not when you switch the VPN off yourself. Android has one built in: Block connections without VPN.

A kill switch is separate from DNS leak protection, so you want both. This test can't see a drop that hasn't happened; it shows what leaves your device while you run it.

When the VPN dropswith and without a kill switch

The VPN connection drops

Without a kill switch

Traffic and DNS fall back to your normal connection, and your provider's address shows.

With a kill switch

Everything is blocked until the VPN reconnects. Android's version: Block connections without VPN.

Proton's standard kill switch acts only on a drop, not when you switch the VPN off yourself.

VPN test: questions and answers

Am I using a VPN right now?

Run the test on this page. If websites see a hosting network, a VPN (or something like one) is on; if they see your home or mobile provider, the VPN isn't routing this browser, whatever the app says. Run it once with the VPN off to see your provider's name, then with it on: that name should be gone from every check.

What does a VPN leak test check?

Whether anything goes around the tunnel. It reads the address websites see, then the three usual ways past a VPN: DNS lookups that still go to your provider, WebRTC handing a page an address you meant to hide, and an IPv6 (or IPv4) connection the VPN doesn't carry. This page runs all four; DNS waits for its button.

Can websites tell I use a VPN?

Often, yes. Most VPN exits are in data centres, and VPN detection services keep lists of such addresses: MaxMind describes flagging hosting addresses "likely to be used as anonymizers", VPN services included. A browser clock in another time zone than your address is a second tell. Neither gives away your own address.

Does a VPN hide my DNS?

Only while your lookups go to the VPN's DNS. If they still go to your provider's DNS server, that's a DNS leak: your provider sees every name you look up. A custom DNS set in your system, or your browser's own secure DNS, can override the VPN's. Press Check DNS too above, or run the full DNS Leak Test.

Does a VPN change my time zone?

No. A VPN changes the address websites see, and with it the time zone tied to that address, but not your device's clock. Any page's script can read the clock's zone, so a site can notice when the two disagree. This test shows both under What websites see. It's a tell, not a leak: your clock's zone doesn't give away your address.

Is iCloud Private Relay a VPN?

No. Apple describes it as protecting your browsing in Safari; it also covers DNS lookups and unencrypted web traffic from apps, not everything an app sends. With it on, websites see an address of one of Apple's relay partners and this test says Private Relay, not VPN. When a VPN is on, the VPN takes precedence.

Why does my VPN show the wrong country?

Locations come from address databases, which are nearly always right about the country and often wrong about the city. Some VPN locations are also virtual: the server sits in another country than the one it's named for (Proton VPN calls this Smart Routing). The countries of DNS servers never count: public DNS answers from many places at once.

Why is my VPN not working on my phone?

Usually the VPN dropped and nothing brought it back, or the app sends only some apps through it. On Android 7.0 and later, turn on Always-on VPN and Block connections without VPN in the VPN's settings (a VPN set up through an app may not offer them there). On an iPhone, turn on the VPN's Connect On Demand. Then run this test again.

Missing something?Suggest a feature or a new tool

Related tools