How to check an always-on VPN after sleep

You open your laptop after it wakes from sleep, and the VPN says it is connected. That does not always mean the tunnel reconnected before other apps could use the internet. A brief gap can matter if your VPN is meant to stay on all the time.

Use the VPN Leak Test to check whether your browser exposes your regular public IP through IPv6 or WebRTC after waking. The test can show a leak at that moment, but it cannot prove that every app was protected during the whole wake-up process.

Check the VPN after sleep

1. While the VPN is connected, open the VPN Leak Test in the browser you normally use. Note the result and, if shown, the public addresses it detects.
2. Put the computer to sleep for a minute or two. Do not disconnect the VPN first. On a phone or tablet, lock the screen and let the device sleep instead.
3. Wake the device and wait for its network connection to return. Check whether the VPN app or system indicator says it is connected. Avoid opening email, banking, or other sensitive services during this check.
4. Run the leak test again as soon as the browser can load it. If the VPN is still reconnecting, note that and wait about 30 seconds, then test again.
5. Compare the first result after waking with the later result. If the first test cannot load, note whether the VPN shows a connection error or whether the device has no internet access.

For a useful comparison, use the same browser before and after sleep. A VPN browser extension may protect only that browser, while a VPN app or system profile may route traffic from more of the device. Check which type you use before drawing conclusions.

What the result means

The test shows the VPN connection both times

If the test does not detect your regular connection through IPv6 or WebRTC, it found no browser leak at the time you ran it. This is reassuring, but it does not prove that no app sent traffic outside the VPN during the moments before the tunnel returned. A VPN exit address can also change when the service reconnects, so a different address by itself does not mean your real IP leaked.

The test detects an address outside the VPN after waking

This suggests that the browser can reach the internet outside the VPN, or that the VPN is not yet fully connected. Check whether the detected address is your regular connection or an address belonging to the VPN service. If you are unsure, ask the VPN provider how to identify its exit addresses. Do not treat a different location or IP address alone as proof of a leak.

The test will not load, or the device has no internet

The VPN may be blocking traffic until its tunnel reconnects. That is often the intended behavior of a kill switch, a setting that blocks internet access when the VPN is down. It can also mean the device has not restored Wi-Fi or mobile data yet. Check the VPN and network indicators, then test again after the connection settles.

The test is clear, but you are still concerned

A browser test checks what a web page can observe through that browser. It does not inspect every app, prove that a kill switch worked during sleep, or confirm that your VPN protects traffic on all networks. For those questions, check the VPN app's connection logs or ask its support team about its sleep and reconnect behavior.

How to fix a leak or a failed reconnect

1. Wait for the VPN to reconnect before browsing. If the app says it is connecting, wait until it reports a connection, then run the test again. If the test cannot load and the VPN has a kill switch enabled, the block may be working as intended.
2. Turn on the VPN's block-without-VPN option. VPN apps may call this a kill switch or network lock. On Windows 11, open Settings › Network & internet › VPN, select your VPN profile, and check its available connection options. The built-in Windows VPN does not show the same always-on controls for every profile, so check the VPN provider's app or ask your workplace administrator if the profile is managed. On macOS, open System Settings › VPN and review the connection options provided for your VPN. Some providers put the kill switch in their own app instead.
3. Check the VPN's always-on setting on a phone. On Android, open Settings › Network & internet › VPN, tap the gear beside the VPN, and check Always-on VPN and, if available, Block connections without VPN. Menu names can vary by device maker. On iPhone, open Settings › General › VPN & Device Management › VPN and check the VPN profile or provider app. iPhone does not offer the same general always-on switch for every personal VPN; managed devices can have additional controls.
4. Remove the browser from split tunneling. Split tunneling sends selected apps outside the VPN. Open the provider's app and check its split-tunneling or excluded-app list. If your browser is excluded, remove it and test again after sleep.
5. Check the network before blaming the VPN. Confirm that Wi-Fi or mobile data reconnects after waking. If the network itself is unavailable, the VPN cannot establish its tunnel. If the VPN connects on another network but not this one, check the router or network restrictions.
6. Update or repair the VPN profile. Install available updates to the VPN app and device operating system, then restart and repeat the sleep test. If the problem continues, ask the provider or your IT administrator to check the profile's reconnect and block-without-VPN settings before removing or reinstalling a managed profile.

What the leak test cannot confirm

The VPN Leak Test checks whether your browser exposes your regular IP through IPv6 or WebRTC while the VPN is on. It is not a packet capture and cannot show exactly what happened while the computer was asleep or before the browser made its test requests. A clean result is evidence about that browser at that moment, not a guarantee about every app or every connection.

Repeat the check after changing VPN settings, installing a VPN update, or switching between Wi-Fi and mobile data. For a work or school device, ask the administrator before changing a managed VPN profile.