Is My VPN Actually Working? The 3-Minute Leak Test

Why "Connected" Doesn't Mean "Working"

Most VPN apps show a green tick and the word "Connected" the moment the tunnel establishes — but that only confirms the tunnel exists, not that all of your traffic is actually going through it. Three specific failure modes let information slip outside the tunnel while the app still reports a healthy connection: IP leaks, DNS leaks, and WebRTC leaks. Each needs a different test, and each one alone is enough to undo the privacy the VPN was supposed to provide.

Test 1: The IP Address Check

This is the most basic test and takes about 30 seconds. Connect to your VPN, choose a server location, then visit an independent IP-checking site such as ipleak.net or whatismyipaddress.com. The IP address and country shown should match your VPN server's location — not your real one. If you connected to a Germany server and the site reports your actual home country, the VPN is not routing your traffic correctly, full stop.

Test 2: The DNS Leak Test

This is the one most people skip, and it is the most common real-world leak. Every time you visit a website, your device looks up its address through a DNS server. A properly configured VPN routes this lookup through its own encrypted DNS servers. A leaking VPN lets these lookups slip out to your regular internet provider's DNS servers instead — meaning your traffic is encrypted, but your ISP can still see a list of every site you visit, just not what you did there.

To test it, connect to your VPN and visit dnsleaktest.com, then run the extended test. It will list which DNS servers actually handled your requests. You want to see your VPN provider's own DNS servers listed — not your ISP's name or your home country's regional provider.

Test 3: The WebRTC Leak Test

WebRTC is a browser feature built for video calls and real-time communication, and it has a long-standing quirk: in some browsers, it can reveal your real IP address directly to any website, completely bypassing the VPN tunnel, even while every other test above passes cleanly. This is a browser-level leak, not a VPN failure, but it happens while your VPN is on, so it feels like the VPN's fault.

Test it at browserleaks.com/webrtc. Look specifically for a "public IP" field showing anything other than your VPN's IP. Chrome and Edge are the browsers most commonly affected; Firefox lets you disable WebRTC entirely through its media.peerconnection.enabled setting in about:config.

What to Do If You Find a Leak

First, check for a kill switch setting in your VPN app and make sure it is turned on — this blocks all internet traffic if the VPN connection drops, rather than silently falling back to your normal connection. Second, look for a "DNS leak protection" or "force VPN DNS" setting, usually in the app's advanced or network settings, and enable it. Third, if WebRTC is the culprit specifically, disable WebRTC in your browser settings or install a WebRTC-blocking extension. If leaks persist after all three steps, the VPN itself has an infrastructure problem, not a settings problem — and it is worth testing an audited alternative.

Why This Matters More on Public Wi-Fi

A leak on your home network mostly exposes browsing habits to your own ISP. The same leak on airport, hotel, or cafe Wi-Fi exposes it to whoever else is on that network, which is a meaningfully different risk. If you regularly connect on public networks, running these three tests once after setup, and again after any major app update, is worth the three minutes it takes.

Frequently Asked Questions

This article contains no affiliate links. The tools mentioned (ipleak.net, dnsleaktest.com, browserleaks.com) are independent, free, and unaffiliated with VPN Compare.