How to Use This Tool
- Choose a supported STUN server or review the prefilled server address.
- Start the candidate-gathering test without granting camera or microphone access.
- Compare host, server-reflexive and masked candidates with your intended connection.
Calculation Method
RTCPeerConnection gathers ICE candidates. A STUN request can reveal a server-reflexive public address; browser privacy policies can mask local addresses with mDNS names.
Worked Example
A private host address such as 192.168.1.20 is not a public Internet address. An mDNS name ending in .local is a masked host candidate, not a failed IP lookup.
Understand Candidate Types
ICE gathers possible routes for a real-time connection. A host candidate originates from an interface visible to the browser. A server-reflexive candidate is an address reported through STUN. A relay candidate uses a TURN service. Their different roles matter more than simply counting every address string.
Modern browsers may replace a local host IP with an mDNS name. That masking changes what a page can read; it does not mean the computer has no private address. The tool should label the masked name rather than invent a location or force it through an ordinary public-IP lookup.
Read Common Candidate Types Before Judging Exposure
Compare Public Addresses with Context
An ordinary HTTPS request and a WebRTC connection do not have to take identical routes. A browser proxy, a VPN split-tunnel policy, IPv6 handling and browser WebRTC settings can all affect the comparison. Record the web IP and each public candidate at the same time.
A public candidate outside the intended VPN route is a useful finding to investigate. It is not enough to infer the user’s original ISP address without a known baseline. Private addresses, documentation addresses and masked hostnames must not be labeled as exposed public home addresses.
Run a Fair Before-and-After Check
Use the same browser profile, network and test server for a baseline and a comparison. Change one setting at a time. Reload after reconnecting a VPN so an old peer connection does not carry observations from the earlier route. Save the observed candidate type and address rather than only a red or green label.
The selected STUN server receives network requests needed for gathering public candidates. A custom server must support the required transport and be one you are entitled to use. This page does not need a video call, camera stream or microphone recording to perform the check.
Interpret Incomplete Results Honestly
A blocked STUN request can leave only host candidates or no public candidate. Browser policy, an extension, a disabled WebRTC implementation or a timeout can also reduce the result. These states cannot be promoted into a claim that every network path is protected.
The observation ends when gathering completes or the deadline is reached. Close the peer connection after the run. A DNS leak test examines resolver routing and is a separate follow-up. Neither test verifies the VPN provider’s logging practices, the safety of websites or the behavior of other installed applications.
What the Result Means
No candidates or an unavailable STUN service is inconclusive. A different public candidate needs investigation but does not on its own prove that a VPN has failed.
Common Questions
Does This Need Camera Access?
Candidate gathering can run through a data channel without requesting camera or microphone permission.
Is Matching the Web IP a Complete Privacy Pass?
No. It describes the candidates observed during this run, not every app, protocol or future connection.