What a WebRTC candidate means in a leak report

Your VPN leak report may show a WebRTC candidate with an IP address, and it can be hard to tell whether that means your real address is exposed. The word candidate describes a possible network route that the browser discovered, not automatically a leak.

Here is how to read the candidate types and compare them with your VPN connection. The VPN Leak Test checks whether your real IP address leaks through WebRTC or IPv6 while the VPN is on.

Check the report with your VPN connected

1. Connect to your VPN, then open the VPN Leak Test in the browser you normally use.
2. Let the check finish. Look for the WebRTC result and any candidate details or addresses it shows.
3. Note whether each address is private or public, and whether a public address matches your VPN connection or your usual internet connection.
4. If you are unsure which public address is yours, run the test once with the VPN off, note the result, reconnect the VPN, and run it again. A change in address is expected, but the VPN address can vary by server.
5. Compare the findings with the VPN app's leak protection settings and its displayed connection status. For more context on what a STUN server can reveal, see what a STUN server can reveal to a browser.

What the candidate type means

WebRTC is a browser technology used for real-time audio, video, and data connections. To set up a connection, it gathers possible routes called ICE candidates. A candidate can include an address, a port, a transport such as UDP or TCP, and a type. The browser and the other participant test possible routes to find one that works.

Host candidate

A host candidate is an address from a network interface on your device. It may be a private address such as 192.168.1.20 or 10.0.0.5, which is used inside a local network and is not directly reachable from the public internet. Browsers may hide this address behind a name ending in .local rather than show the numbers.

A private host candidate is not the same as exposing your public home IP address. It can reveal limited information about a local network, but on its own it does not prove that traffic escaped the VPN.

Server-reflexive candidate

A server-reflexive candidate, often shortened to srflx, is an address learned by asking an outside server what address it sees. It often represents the public-facing address and port created by your router or VPN connection. This is the candidate type people often worry about in a leak report.

Check the address, not just the type. If it is the VPN's public exit address, that is generally expected while the VPN is connected. If it matches the public address you get with the VPN off, the browser may be reaching the internet outside the VPN. A STUN result does not automatically mean a call or website used that route.

Relay candidate

A relay candidate, shown as relay, is an address on a TURN server. WebRTC can send traffic through that server when a direct route will not work. A relay address usually identifies the relay service, not your home connection, although the surrounding network setup still matters.

Peer-reflexive candidate

A peer-reflexive candidate, often shown as prflx, is discovered during connection checks when one device receives traffic from an address it did not already know about. It is less common in basic leak reports. Its presence alone does not show that your real IP was exposed.

How to read the result

The report shows only a private address

This is usually a local network address, not your public ISP address. It is not, by itself, evidence of a VPN leak. If the test also reports that WebRTC exposed a public address, investigate that separate result.

A public candidate matches the VPN address

That is generally what you want to see: the browser appears to be using the VPN route for that candidate. It does not prove that every app on the device uses the VPN, or that the VPN protects other kinds of traffic.

A public candidate matches your non-VPN address

This is a warning sign if the VPN is meant to route all browser traffic. Check whether the VPN uses split tunneling, which sends selected apps or traffic outside the tunnel, and whether its leak protection is enabled. For a broader guide, see how to check whether your VPN leaks your IP address.

The address is hidden or the result is unclear

A browser may hide a local address, and VPN providers may use several exit addresses. A candidate list can also include possible routes that were never selected. Do not treat a hidden address or a candidate label by itself as proof of a leak. Use the test result and compare known addresses while the VPN is on and off.

How to fix a possible WebRTC leak

1. Reconnect the VPN. Disconnect and reconnect to a VPN server, then run the test again. A dropped or partially connected tunnel can leave the browser using the regular network.
2. Check the VPN app's leak protection. Look for options that block traffic outside the VPN, prevent leaks, or block IPv6. Their names and locations vary by app. If you use the operating system's built-in connection, check Settings › Network & internet › VPN on Windows 11 or System Settings › VPN on macOS, and confirm the connection is active.
3. Review split tunneling. If split tunneling is on, check whether your browser is excluded from the VPN. Add the browser to the protected apps or turn split tunneling off if you want the VPN to cover all browser traffic.
4. Check IPv6 handling. Some VPNs protect IPv4 traffic but do not route IPv6. Use the VPN app's setting to block or tunnel IPv6 if available. Avoid changing system network settings unless you understand the effect on other connections.
5. Retest in a clean browser session. Close and reopen the browser, connect the VPN first, and run the check again. If only one browser shows the issue, update it and review any extensions or network tools that change how it connects.
6. Contact the VPN provider if the address still matches. Send the test details without sharing passwords or account credentials. Ask whether the address is a known VPN exit address and whether their service protects WebRTC and IPv6 traffic.

What a candidate does not prove

A candidate is a route the browser can try. The list does not necessarily tell you which route a WebRTC call selected, and one candidate does not describe all traffic from your device. A browser leak check is useful for the browser and network conditions tested at that moment. Repeat it after changing VPN settings or switching networks.