WireGuard and encryption
Malwarebytes says its VPN uses the WireGuard protocol with 256-bit ChaCha20 encryption. There is no protocol choice to make before a test, so results should not depend on a protocol setting.
Provider-neutral self-test pilot
Malwarebytes Privacy VPN Leak Test
Malwarebytes Privacy VPN runs on WireGuard and is built with AzireVPN, which Malwarebytes acquired in 2024. The provider lists native IPv6 support, so on this service the IPv6 line can carry a VPN address instead of going blank. Malwarebytes recommends leaving the app's DNS setting at its default, so a test that names an unexpected resolver may reflect a changed setting. On Android, split tunneling lets chosen apps bypass the VPN.
Live test
Run the test on Malwarebytes Privacy VPN now
Malwarebytes lists native IPv6 support, so an IPv6 line showing a VPN address is expected; one showing your home provider's IPv6 is the line to investigate. If you changed the Windows DNS setting, a DNS line naming a different resolver may come from that choice.
This browser session
Leak report
- Verdict
- Visible IP
- Not tested
- DNS
- Not tested
- WebRTC
- Not tested
- IPv6
- Not tested
- Browser
- Not tested
- Next step
This reports what your browser shows in this session. It does not certify Malwarebytes Privacy VPN, does not test every server, app or device, and does not prove anonymity.
Current-session checks
What this Malwarebytes Privacy VPN self-test checks
Before testing, check that no apps are excluded through Android split tunneling and that the DNS setting is at its default. Either one can change what the DNS and IP lines report.
Run the VPN Leak Test
Review IP, DNS, WebRTC, IPv6 and browser/session signals together.
Check DNS signals
Review limited resolver-signal behavior for this browser session.
Review WebRTC exposure
Check browser WebRTC candidate behavior.
Check IPv6 visibility
Review whether IPv6 appears in visible signals.
Review browser fingerprint
Check browser characteristics a VPN usually does not change.
Read the methodology
Review the limits before interpreting results.
Before you read the result
What Malwarebytes Privacy VPN documents about these signals
When connected, the IP, DNS and IPv6 lines should all point to the chosen Malwarebytes server location.
IPv6
In a comparison table on its VPN page, Malwarebytes lists native IPv6 as supported. With the VPN on, an IPv6 address on the test should belong to the VPN, not your home provider. A home IPv6 address is the result worth reporting to support.
DNS settings
The Windows and Mac apps have a DNS setting, and Malwarebytes recommends not changing the DNS server from the default. If the DNS line shows a resolver you did not expect, check this setting first.
Kill switch and reconnects
On Windows and Mac, the Kill Switch setting is disabled by default and needs Auto connect turned on. On iOS, Auto Connect tries to reconnect whenever the connection is lost. Android relies on the system option that blocks internet access when the VPN disconnects.
Infrastructure and audit
Malwarebytes says its servers run entirely in RAM, without disks, and that local and remote server access is blocked after deployment. In April 2026 it published an X41 D-Sec audit of server hardware and server-side software, which found two critical issues; Malwarebytes said it had fixed one and was working on the other.
Between the readings
Record a kill-switch drop on Malwarebytes Privacy VPN
On Windows and Mac, Malwarebytes describes a Kill Switch setting that is off by default, can be turned on only once Auto connect is enabled, and stops the computer reaching the internet while the VPN is off. On Android the equivalent is the system's block option.
Independent audits
Audits Malwarebytes Privacy VPN has published or announced, newest first. “What was checked” is the scope the audit itself states; anything outside it was not examined. Compare audits across providers or see every published VPN audit by date.
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| 2 Apr 2026 | X41 D-Sec | Servers and infrastructure | Server infrastructure shared with AzireVPN: hardware and server-side software | 2 critical, 2 medium, 2 low | Report malwarebytes.com blogRead 19 Oct 2026 |
Who runs Malwarebytes Privacy VPN, and on what
- Company
- Malwarebytes Inc., United States. Outside the US and Canada the EULA names Malwarebytes Limited, Ireland. malwarebytes.comRead 19 Oct 2026
- RAM-only servers
- Malwarebytes says all servers run entirely in RAM and are prepared without disks. malwarebytes.comRead 19 Oct 2026
Who owns which VPN: every provider’s company and the groups that run several brands.
What this cannot prove
- This checks visible browser/session signals only.
- This does not certify the provider.
- This does not test every server, app, device, or connection.
- This does not prove anonymity.
- This does not prove every security condition.
- A clean result does not prove every leak is absent.
How to compare before and after on Malwarebytes Privacy VPN
- With Malwarebytes VPN off, run the test and note your IP, DNS and IPv6 lines.
- Turn the VPN on in the Malwarebytes app and pick a server location.
- Rerun the test in the same browser without closing it.
- Expect IP, DNS and IPv6 to move to the VPN; apps excluded through Android split tunneling keep your normal address.
Safe Copy limits
Safe Copy exports use safe summary categories and remove raw IP, exact city, full user-agent, raw fingerprint data, raw resolver IPs and WebRTC candidates. It is not a certificate, provider audit, or proof of anonymity.
FAQ
Malwarebytes Privacy VPN leak test FAQ
Who runs Malwarebytes Privacy VPN?
The EULA names Malwarebytes Inc., a Delaware corporation, and Malwarebytes Limited, incorporated in Ireland. The VPN is built with AzireVPN, which Malwarebytes acquired in November 2024.
Is the kill switch on by default?
Not on Windows and Mac. Malwarebytes says the Kill Switch setting is disabled by default and can be turned on only when Auto connect is enabled.
Does Malwarebytes Privacy VPN support IPv6?
Its VPN page lists native IPv6 as supported. On a leak test, a connected device should show a VPN IPv6 address rather than your home one.
Which protocol does it use?
Malwarebytes says it uses WireGuard with 256-bit ChaCha20 encryption.
Has the service been audited?
Malwarebytes published an X41 D-Sec audit of its server infrastructure in April 2026. It found two critical issues; Malwarebytes said one was fixed and the other was being worked on.
Does the free version behave differently?
Malwarebytes says the limited free VPN has fewer servers and slows down after 10 GB of data.