Introduction
The VPN app says "Connected" and shows a green shield. That proves the app has opened a tunnel to a server. It does not prove that everything your device sends goes into that tunnel, or that it stays there when the connection drops for a few seconds.
A VPN test answers three questions. Has the address that websites see changed? Does anything get out around the tunnel, such as DNS lookups, WebRTC or IPv6 traffic? And what happens to your traffic when the VPN drops? Each check below comes with what a good and a bad result look like, and what to change when it fails.
A different question often gets mixed in: can a website tell that you use a VPN? Often it can, even when the VPN works perfectly, so a "VPN detected" message on its own says nothing about leaks. Detection has its own section near the end.
Is my VPN working? What "working" means
A VPN that works does three things.
- It replaces your address. Every site sees the VPN server's IP and the place that IP is registered to, not your home network.
- It carries everything. Name lookups (DNS), browser features such as WebRTC, and both kinds of internet address, IPv4 and IPv6, go through the tunnel, unless you chose to send something around it.
- It fails closed. When the tunnel drops, traffic stops instead of quietly going out the normal way.
The first point is easy to see for yourself. The other two take a closer look, and that is what an IP leak test is for. An IP leak is any path by which your real address still reaches a website while the VPN is on.
Am I using a VPN? The ten-second check
The quickest answer to "is my VPN on?" is your IP address. Open a page that shows it, once with the VPN off and once with it on. Three things should change.
- The IP address. With the VPN on, it should belong to the VPN provider, not to your internet provider.
- The network owner. Lookup tools show the organisation and the network number (ASN) behind the address. With the VPN on, that is usually a hosting company or the VPN brand itself, not your ISP.
- The location. The country should match the VPN server you picked.
If all three still show your provider and your town, the VPN is not hiding your IP or your location at all, because it is not carrying your browser's traffic. Check that it is connected, that the browser is not excluded from the tunnel, and, if you use a browser extension rather than an app, that the extension is switched on.
The city does not have to match exactly. IP location databases work from registration records and other indirect signals, so a VPN server can be listed in a different city, or even a different country, from the one it runs in. When your VPN shows the wrong location, the database is more often at fault than the VPN.
VPN leak test: five ways your real IP gets out
In every case below the VPN is connected and the address check above passes. The leak happens on a different path, which is why the simple check misses it.
DNS leak
Before your browser connects to a site, it asks a DNS resolver for the site's address. If those questions go to your internet provider's resolver instead of through the tunnel, the provider sees the name of every site you open. A website can also notice that your lookups and your connection come from two different networks.
A DNS leak test makes your browser look up a random name that has never been used, under the tester's own domain. The tester runs the name server for that domain, so it sees which resolver asked the question. It sees the resolver's address, not yours, because the resolver forwards the question in its own name.
- A resolver on your VPN's network is the normal result.
- A big public service, such as Google Public DNS or Cloudflare, reached through the tunnel, is fine too. The address may look unfamiliar: Google Public DNS, for one, sends its queries from its own data centers, so a test shows one of Google's server addresses rather than 8.8.8.8.
- A resolver on your home provider's network while the VPN is on means the lookups escaped the tunnel. That is the leak.
The usual causes are a VPN app that does not set its own DNS, an operating system that tries other network interfaces when a lookup is slow (Microsoft's documentation says Windows sends DNS queries "on all interfaces" when a query times out), and IPv6 DNS servers handed out by your router, covered below. Many VPN apps have a DNS leak protection option. Turn it on, and see the DNS leak guide for the other fixes.
The browser's own secure DNS setting (DNS over HTTPS) changes which resolver answers. With a full-tunnel VPN that traffic still travels inside the tunnel, so a test shows a different resolver, not your provider's.
WebRTC leak
WebRTC lets a browser make video calls and share files directly with another browser. To find a direct route, it asks a STUN server what address it sees the browser coming from, and that question can take a different path than your web pages. The IETF rules for this behaviour, RFC 8828, name two setups that leak. Behind a proxy, if direct internet access is still possible, "WebRTC's STUN checks will bypass the proxy and reveal the public IP address of the client". With a split tunnel, WebRTC can find "not only the public address for the VPN, but also the ISP public address".
Chrome has hidden your local addresses, the 192.168.x.x kind, since version 76 by replacing them with random .local names, unless the site already has your camera or microphone permission. Your public address is not hidden that way.
So a full-tunnel VPN app rarely leaks through WebRTC: the only public address the browser can find is the VPN's. The usual cases are browser VPN extensions, which are proxies, and split tunnels. A WebRTC leak test shows the addresses your browser hands out, and the WebRTC leak guide has the setting that stops it in each browser.
IPv6 leak
Many home connections now have two addresses, an IPv4 one and an IPv6 one. Some VPN apps tunnel only IPv4. RFC 7359 describes what happens then: "any packets destined to an IPv6 address will be sent in the clear using the local IPv6 router." Sites that answer over IPv6, and many large ones do, see your real IPv6 address, while a checker that uses only IPv4 shows the VPN and reports no problem.
An IPv6 leak test needs a checker that can reach you over both. If it shows a second address next to the VPN's, look at who owns it. An IPv6 address that belongs to your home provider means IPv6 goes around the tunnel. Turn on the VPN's IPv6 support or its IPv6 leak protection. If it has neither, RFC 7359 suggests switching IPv6 off on the device, and calls that a temporary workaround.
Apps and sites outside the tunnel
Split tunneling sends some apps or addresses around the VPN on purpose, a banking app or a printer on the local network, say. Whatever goes around shows your real address. That is by design, and it is easy to forget which apps you excluded months ago. The VPN vs Proxy vs Tor guide explains split tunneling and the kill switch in more detail.
A browser VPN extension is a different case. In Chrome and Firefox, an extension like that changes the browser's proxy settings, so it covers that one browser and nothing else. Games, chat apps, system updates and every other browser keep your real address. And because it is a proxy, WebRTC can get around it unless the extension also changes the browser's WebRTC policy. A good extension does that. Check whether yours does with a WebRTC test while it is on.
So if you are asking "am I using a VPN or a proxy?", a browser extension is in practice a proxy, even when it is sold as a VPN.
Routes that skip the tunnel on public Wi-Fi
In 2024 researchers at Leviathan Security published TunnelVision (CVE-2024-3661). A hostile network, such as fake café Wi-Fi, can push routing rules through a standard network setting (DHCP option 121) that send chosen traffic around the VPN, while the VPN app still shows "Connected". It affects Windows, Linux, iOS and macOS. Android is not affected, because it does not support that option. A kill switch did not help in their tests: in their words, "the kill switch was never engaged."
A test at home cannot catch this, because it depends on the network you join. Run the checks on the untrusted network itself. On networks you don't trust, a phone's hotspot avoids the problem.
VPN kill switch test: what happens when the VPN drops
Tunnels drop when the Wi-Fi changes, the server restarts or the laptop wakes from sleep. If your VPN keeps disconnecting, each drop is a short window in which your device may send traffic the normal way, from your real address. A kill switch closes that window by blocking all traffic until the tunnel is back.
A VPN kill switch test checks whether it really does. Keep a page that shows your IP address open and reload it while you break the connection the hard way: switch to another Wi-Fi network, or turn the network off and on again. Pressing "Disconnect" in the app is not a fair test, because some apps treat a manual disconnect as your choice and lift the block. During the gap the page should fail to load. If it loads and shows your real address, the kill switch is off or does not cover that case.
Where the setting lives depends on the system. Android has it built in since version 7.0: an always-on VPN plus a "Block connections without VPN" switch in the VPN settings. On iPhone, iPad and Mac, the VPN app turns on Apple's equivalent itself, so look for a kill switch option in the app. Windows has a system lockdown mode for VPNs, but it is configured through company device management, so on a personal PC the kill switch is the VPN app's own.
VPN detected: when a working VPN is still spotted
A VPN that passes every check above can still be recognised. A site does not need one decisive test. It can add up clues: an address in a data-center range that IP databases already label as a VPN, a browser time zone that does not match the address, the resolver your lookups come from, a WebRTC address, slightly smaller packets inside a tunnel, the browser's own fingerprint. The VPN vs Proxy vs Tor guide explains these six clues one by one. VPN detection tells a site only that you use a VPN, not who you are.
Some services look for VPNs on purpose. Roblox's Community Standards forbid "Using VPNs to mask your location in order to gain unauthorized access to Roblox, including to a specific feature or account". Roblox also says it looks at VPN use, along with billing and account history, when it decides which country's prices a player gets. For a service like that, a working VPN is expected to be visible. A VPN can also raise your ping in online games, because every packet takes a detour through the VPN server.
VPN checker results: what each finding means
| Check | Good result | Problem | What to do |
|---|---|---|---|
| IP address and network owner | The VPN provider or a hosting company | Your internet provider | Reconnect, check the browser is not excluded, switch the extension on |
| DNS resolver | The VPN's network, or a public DNS service through the tunnel | Your provider's resolver: a DNS leak | Turn on the app's DNS leak protection or its own DNS |
| WebRTC | No address, or only the VPN's | Your provider's address: a WebRTC leak | Change the browser's WebRTC setting or the VPN's WebRTC protection |
| Second address (IPv6) | None, or one that also belongs to the VPN | An IPv6 address from your provider: an IPv6 leak | Turn on the VPN's IPv6 support, or switch IPv6 off for now |
| Time zone | Matches the VPN country | Differs. Not a leak, but a clue sites use | Usually nothing. See the time zone guide |
| Kill switch | Pages stop loading while the VPN is down | Pages load from your real address | Turn the kill switch on, or Android's "Block connections without VPN" |
Run the VPN test on packet.guru
The Privacy & Trust Index works as a free VPN checker: it runs most of these checks at once and shows what a website sees. Run it once with the VPN off and once with it on, then compare these cards.
- IP Reputation says VPN / PROXY when your address belongs to a VPN or proxy service.
- Network Details lists your address, its ISP, organisation and ASN, and the DNS server your lookups came from. When your connection also leaves over the other address family, it shows that second address too. If one of the two belongs to your home provider, that is the IPv6 leak described above.
- DNS Privacy says DNS LEAK when your lookups come from a consumer network other than your VPN's, and TUNNELED DNS, NO DNS LEAK or PUBLIC DNS when they are fine.
- WebRTC Status is fine at SAFE or PUBLIC IP MATCH, the second meaning WebRTC found only the address you already connect from. LEAK DETECTED means it exposed a different public address.
- Regional Integrity shows TIMEZONE MISMATCH when your clock and your address point to different regions, a clue rather than a leak.
A web page cannot switch your VPN off for you, so the kill switch stays a manual test. Do the drop test from the kill switch section, then repeat the check once the VPN has reconnected.
FAQ
How do I know if my VPN is working?
Compare your IP address with the VPN off and on. With it on, the address, its owner and the country should all belong to the VPN. Then check that DNS, WebRTC and IPv6 show nothing from your home provider, and that pages stop loading when the VPN drops.
What is an IP leak?
Any path by which your real address reaches a website while the VPN is connected. The common ones are DNS lookups sent to your provider, WebRTC behind a proxy or split tunnel, IPv6 traffic that the VPN does not carry, and traffic during a dropped connection.
Why does my VPN show the wrong location?
Location lookups come from IP databases, not from the server itself, and they can list a VPN server in another city or country. If the address belongs to the VPN, the VPN is working. The location label is a database guess.
Can websites detect a VPN?
Often, yes. Many VPN servers sit in address ranges that IP databases label as hosting or VPN, and a site can add other clues such as your time zone. Detection tells the site that you use a VPN, not who you are.
Why does a site say "VPN detected" when I don't use one?
Your address may be shared or have a history. Mobile networks put many customers behind one address, some providers' ranges look like hosting, and an address once used by a VPN can stay on lists. Apple's iCloud Private Relay and Cloudflare WARP also change your address. The IP reputation guide explains how those labels work.
Does a VPN browser extension protect my whole device?
No. It changes the proxy settings of one browser, so other apps and browsers use your real address. Use the VPN app if you need the whole device covered.