Browser Leak Test
What Your Browser Reveals Right Now
Run a free browser leak test covering WebRTC IP exposure, IPv6 leaks, canvas fingerprint, audio fingerprint, WebGL GPU data, system fonts, battery API, timezone mismatches and sixteen more — twenty-four checks in all, each one run in your own browser and none of it stored. See exactly what websites see about your device fingerprint. No extensions needed — works on Chrome, Firefox, Edge, Safari, and Brave.
Quick Answer: Is Your Browser Leaking Data?
A browser leak test runs twenty-four checks including WebRTC IP leaks (exposes your real IP behind a VPN), IPv6 exposure (the leak most VPNs miss), canvas and audio fingerprints (tracks you without cookies), WebGL GPU data, battery status, and timezone mismatches. Our tool runs all checks instantly in your browser and calculates a privacy score showing your overall leak exposure.
Privacy Leak Scanner
Scanning 20+ leak vectors...
Network Leaks
Fingerprinting
Hardware & System
Privacy Settings
Jessica Wright
Cybersecurity Threat Researcher
Jessica specializes in browser privacy analysis, fingerprinting detection, WebRTC leak research, and data privacy compliance. She helps individuals and organizations understand and reduce their digital exposure.
View All ArticlesWhat Is a Browser Leak Test and Why Should You Care?
A browser leak test scans your browser for privacy vulnerabilities that expose your identity to websites, advertisers, and trackers. Even if you use a VPN, your browser can still leak your real IP address through WebRTC, expose an IPv6 address the tunnel never covered, and create a permanent tracking ID through canvas fingerprinting, audio fingerprinting, and WebGL GPU data.
Our tool checks 20+ leak vectors in one scan. It detects network-level leaks (WebRTC, DNS, IPv6), fingerprinting risks (canvas, audio, WebGL, fonts), hardware exposure (CPU, RAM, screen, battery), and privacy settings (DNT, cookies, storage, timezone). The privacy score tells you how exposed your browser is on a scale from 0 (fully protected) to 100 (heavily leaking).
20+ Checks in One Scan: Instead of running separate tools for each leak, our browser leak test combines WebRTC, DNS, fingerprinting, hardware, and privacy checks into a single page. Check individual leaks in detail with our Canvas Fingerprint, Audio Fingerprint, and Battery Leak tools.
WebRTC IP Leak: The Most Dangerous Browser Leak
WebRTC (Web Real-Time Communication) enables video calls and P2P connections in browsers. The problem is that WebRTC can expose your real local and public IP addresses — even when you are connected to a VPN. This happens because WebRTC creates peer connections using STUN servers that bypass your VPN tunnel.
Our test creates an RTCPeerConnection and collects ICE candidates to check if your real IP leaks. If you see your ISP's IP alongside your VPN IP, you have a WebRTC leak. This is the single most common VPN bypass and the reason many privacy-conscious users think they are protected when they are not. If the row above shows an address you recognise as your own, our step-by-step walkthrough of how to close a WebRTC leak covers each browser in turn, and the dedicated WebRTC leak test re-checks just that one thing after you change a setting.
// How WebRTC leaks your IP (simplified)
const pc = new RTCPeerConnection({
iceServers: [{urls:'stun:stun.l.google.com:19302'}]
});
pc.onicecandidate = e => {
// This reveals your REAL IP, bypassing VPN
console.log(e.candidate.address);
};
VPN Users: A WebRTC leak defeats the entire purpose of your VPN. Fix it now: Firefox → about:config → media.peerconnection.enabled → false. Chrome → install uBlock Origin → enable WebRTC leak prevention. Then re-run this browser leak test. Check your VPN IP with our WebRTC Leak Test.
DNS Leaks: Why This Page Will Not Pretend to Test One
When you type a website address, your browser asks a DNS resolver to turn that name into an IP address. If you are on a VPN but those queries still go to your ISP's resolver, your ISP has a list of every site you visited — the tunnel encrypted the traffic and told on you anyway. That is a DNS leak, and it is a real problem worth checking.
It is also a problem this page cannot check, and it is worth explaining why rather than showing you a number that means nothing. Detecting your resolver is not something JavaScript can do. The only way it works is for the test operator to run their own authoritative nameserver, hand your browser a one-off hostname, and watch which resolver turns up to ask about it. That is a piece of DNS infrastructure, not a page script. Any browser test claiming to read your resolver without it is either running that infrastructure quietly or guessing.
What this page can tell you instead is whether the two leaks a browser genuinely can see are open: WebRTC, which hands out your real address through the ICE candidate list, and IPv6 exposure, where the VPN carries IPv4 while IPv6 takes the direct route. Both are checked above, and both are more common than a DNS leak in practice. Fix those first — a DNS leak with WebRTC already wide open is the smaller of your two problems.
For the DNS side of things, our DNS Lookup tool resolves records for a domain and shows what is published, and how a resolver actually walks the DNS tree explains the mechanics of where a query goes and who sees it along the way.
Torrent IP Leak: Why a Clean Browser Test Is Not the Whole Answer
A torrent leak test and a browser leak test answer two different questions, and confusing them is how people end up exposed while believing they are covered. Your browser and your torrent client are separate programs with separate network paths. The browser can be routed perfectly through the tunnel while the torrent client talks to the swarm directly, and nothing on this page would show it.
The only way to measure what your torrent client actually announces is to put a tracker in front of it: the test generates a magnet link or torrent file, your client joins, and the tracker records the address it arrived with. That is the address every peer in the swarm can see. It needs a running tracker, so this page does not claim to do it — but you should run one of the dedicated torrent IP leak tests that does, and know what you are looking for when you do.
What this page does tell you about a torrent leak
Two of the three usual causes are visible from here, and both are in the scan above:
- IPv6 exposure. This is the most common reason a torrent IP leak happens on a setup that otherwise looks fine. Plenty of VPNs tunnel IPv4 and leave IPv6 to route normally. Your browser check passes, your torrent client announces an IPv6 address that belongs to you, and the swarm sees it. If the IPv6 row above shows an address rather than Not Exposed, fix that before you test anything else.
- WebRTC exposure. Not a torrent path in itself, but it is the same failure — traffic escaping the tunnel — and if WebRTC is handing out your real IP, the routing on that machine is not doing what you think it is.
- Client binding. This one is invisible to any web page. Most torrent clients can be bound to a specific network interface, so they refuse to move data when the VPN adapter is down. Until that is set, a dropped tunnel means your real address goes into the swarm without warning.
The order that actually works: clear the IPv6 exposure shown above, bind the client to the VPN interface, and only then run a tracker-based torrent test. Running the torrent test first tells you that something leaked without telling you which of the three causes it was, and you end up changing settings at random.
If a torrent test does come back showing an address you do not recognise, an IP lookup will tell you whose network it belongs to — that is usually how people discover it is their own ISP rather than the VPN they are paying for. Our guide to checking whether a VPN is leaking covers the full sequence.
Canvas, Audio and WebGL Fingerprinting: Tracking Without Cookies
This is the part people underestimate. Clearing cookies takes a second and undoes nothing here — the signals below survive a cleared browser, a new session and incognito, which is exactly why trackers moved to them. We wrote separately about how fingerprinting follows you after you clear cookies or switch devices, because the modelling has got considerably better at it in the last two years.
Cookies are easy to delete. Browser fingerprinting is not. Websites use your browser's unique rendering characteristics to create a persistent tracking ID. The three main fingerprinting vectors are:
- Canvas fingerprint: Your GPU renders text and shapes slightly differently from every other device. The pixel data creates a unique hash. Test it with our Canvas Fingerprint tool.
- Audio fingerprint: The AudioContext API processes sound waves with tiny hardware-specific variations. These variations create a unique audio hash. See it with our Audio Fingerprint tool.
- WebGL fingerprint: The WebGL API exposes your GPU vendor, renderer model, max texture size, and shader precision. These details narrow you down to a very small group of users.
Combined with system fonts (check with our Font Leak Tester), screen resolution, timezone, and language, these create a fingerprint that is unique to your device and persists across sessions, incognito mode, and even VPN usage.
Reduce Fingerprinting: Use Brave browser (randomizes canvas and audio), enable Firefox privacy.resistFingerprinting, or use Tor Browser. Our Browser Info tool shows your full User-Agent and fingerprint data. Our Hardware Info tool shows what GPU and CPU data your browser exposes.
Hardware Leaks: Battery, CPU, RAM and Screen Data
Your browser exposes hardware details that contribute to fingerprinting. The Battery Status API reveals your exact battery percentage and charging status — researchers proved this can track users across websites. navigator.hardwareConcurrency exposes your CPU core count, and navigator.deviceMemory shows your RAM estimate (capped at 8 GB by browsers for privacy).
Screen resolution, device pixel ratio (DPR), and color depth further narrow your identity. A user with 2560×1440 resolution, DPR 1.5, and 8 CPU cores is far more identifiable than someone with the common 1920×1080, DPR 1.0, and 4 cores. Check your full hardware profile with our Hardware Info tool and display details with our Screen Resolution Checker.
Test your battery exposure with our Battery Leak Test. Check timezone mismatches with our Timezone Audit. Audit referrer leaks with our Referrer Leak Test.
Privacy Settings: DNT, Cookies, Storage and Language
Do Not Track (DNT) is a browser setting that asks websites not to track you. Unfortunately, it is not legally binding and most websites ignore it. Worse, having DNT enabled actually makes you more identifiable because only about 12% of users enable it — so it adds to your fingerprint entropy rather than reducing it.
Cookies and web storage (localStorage, sessionStorage) are the traditional tracking mechanisms. Our tool checks if these are enabled and accessible. If you have disabled cookies but left localStorage enabled, trackers can still store identifiers. Inspect your cookies with our Cookie Checker.
Your language setting (navigator.language) and timezone (Intl.DateTimeFormat) reveal your geographic region. If your VPN shows you in Germany but your timezone says America/New_York, that mismatch is a clear signal you are using a VPN. Check TLS fingerprints with our JA3 Fingerprint tool.
How to Fix Browser Leaks: Step-by-Step Guide
- Step 1: Run this browser leak test to see your current exposure level.
- Step 2: Fix WebRTC leaks — disable in Firefox (
about:config) or use uBlock Origin in Chrome. - Step 3: Fix DNS leaks — configure your VPN to use its own DNS, or set DNS to 1.1.1.1 or 9.9.9.9.
- Step 4: Disable IPv6 if your VPN does not support it — prevents IPv6 bypass.
- Step 5: Reduce fingerprinting — use Brave browser or enable
privacy.resistFingerprintingin Firefox. - Step 6: Clear cookies and storage, then use our Cookie Checker to verify.
- Step 7: Secure your passwords with our Password Generator. Check headers with our Headers Analyzer.
- Step 8: Re-run this test to verify all leaks are fixed. Check your SSL with our SSL Checker.
Read our digital footprint guide, fix 550 RBL errors, IP for bulk email, and cold emailing guide.
Understanding Your Privacy Score
Our privacy score calculates your overall leak exposure from 0 (fully protected) to 100 (maximum leaking). Here is how we calculate it:
| Leak Vector | Weight | Risk Level |
|---|---|---|
| WebRTC IP Leak | 20 points | Critical |
| Canvas Fingerprint | 15 points | High |
| WebGL GPU Data | 10 points | High |
| Audio Fingerprint | 10 points | High |
| Battery API | 5 points | Medium |
| System Fonts | 10 points | Medium |
| Hardware (CPU/RAM/Screen) | 15 points | Medium |
| Privacy Settings (DNT/Cookies/TZ) | 15 points | Low-Medium |
Score 0-25 = Well Protected. Score 26-60 = Moderate Exposure. Score 61-100 = High Risk.
Frequently Asked Questions About Browser Leaks
Q What is a browser leak test?
A browser leak test runs twenty-four privacy checks including WebRTC IP leaks, IPv6 exposure, canvas fingerprint, audio fingerprint, WebGL, fonts, battery, and timezone to show what data your browser exposes to websites.
Q How to check for WebRTC leaks?
Our tool creates an RTCPeerConnection and collects ICE candidates. If your real ISP IP appears alongside your VPN IP, you have a WebRTC leak. Fix in Firefox via about:config or use Brave browser.
Q What is DNS leak and how to fix it?
A DNS leak sends your DNS queries to your ISP instead of your VPN. Fix it by enabling DNS leak protection in your VPN settings or manually setting DNS to 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9).
Q Can websites track me without cookies?
Yes. Browser fingerprinting uses canvas, audio, WebGL, fonts, screen, and hardware data to create a unique device ID. This works in incognito mode and survives cookie deletion.
Q How to fix WebRTC leak in Chrome?
Chrome does not have a built-in WebRTC disable option. Install uBlock Origin and enable WebRTC leak prevention, or switch to Brave browser which blocks WebRTC leaks by default.
Q Does incognito prevent fingerprinting?
No. Incognito only stops saving cookies and history locally. Your canvas hash, WebGL data, CPU cores, screen resolution, and other hardware characteristics stay identical. Use Brave or Tor for real protection.
Q What is Battery API leak?
The Battery API exposes exact battery percentage and charging status. Two websites comparing your battery at 37% charging can link your visits. Firefox removed this API. Our test checks if your browser still exposes it.
Q How to reduce browser fingerprint?
Use Brave (randomizes canvas/audio), enable Firefox resistFingerprinting, disable WebRTC, use common resolution (1920×1080), limit fonts, and use a VPN. Re-run our test to check improvements.