Short answer: A WebRTC leak check looks at browser ICE candidates that can differ from the public page IP. Modern browsers often mask local candidates, but VPN, proxy extension, STUN, browser policy, and permission behavior can still create useful exposure signals.
Use this hub when the VPN appears connected but the browser may still expose public, private, local, masked, or limited network candidates through WebRTC.
Quick answer
- Start with WebRTC Leak Test because it lists the ICE candidates the browser is willing to hand out, which is a different question from the address a normal page request shows.
- A masked mDNS hostname in place of a local address is normal in current browsers and is not the result to act on.
- The candidate worth investigating is a public one pointing at your own ISP while a VPN is connected.
- Candidate behaviour is set per browser, and Firefox is the only one of the two below that exposes named preferences for changing it.
WebRTC Leak at a glance
| Signal | What it means | Best next step |
|---|---|---|
| Public candidate | A browser candidate that may show an internet-routable address. | Compare it with What Is My IP and VPN Leak Test. |
| Private/local candidate | LAN-style addresses can appear in some browsers or configurations. | Treat as browser session signal, not full device proof. |
| mDNS masking | Modern browsers may replace local IPs with masked hostnames. | A masked result can still be normal and useful context. |
| STUN behavior | Candidate gathering depends on browser, network, and policy. | Run the WebRTC Leak Test in the target browser. |
| VPN/proxy mismatch | The page IP can differ from WebRTC candidates. | Run VPN Leak Test after connecting the VPN. |
| Receipt | A safe receipt records categories without raw WebRTC candidates where available. | Use Safe Copy after the test. |
Limits and methodology
MyIPScan topic hubs organize practical checks around observable browser and network signals. Results are snapshots for this browser, device, network, and time. They do not prove full anonymity, do not replace provider documentation, and do not test every app on the device.
For transparent limits, see the MyIPScan methodology, editorial policy, and author profile.