Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A VPN is behaving as expected only when your test traffic follows the VPN path: websites see the VPN’s public address, DNS lookups use the intended resolvers, and separate IPv6 and WebRTC paths do not reveal your ordinary connection. Test those properties independently. Start with the VPN disconnected, record a baseline, reconnect to the same device and browser, then repeat an IP check, DNS-specific test, WebRTC check and IPv6 check.
What a VPN leak test can—and cannot—tell you
A public-IP page, a DNS test, a WebRTC test and an IPv6 test observe different traffic paths. Passing one does not prove that the others are protected. A normal web page generally shows the address used for that page request; it does not automatically reveal which DNS resolver handled the hostname, whether a browser’s WebRTC stack can discover another address, or whether applications are sending traffic over IPv6 outside the VPN tunnel.
Browser tests are practical diagnostics, not packet-level audits. Their results describe the specific device, browser, operating system, network, VPN server, protocol and connection state you tested. They do not certify every application or every future transition. For broader confidence, repeat the procedure after changing servers, switching between Wi-Fi and mobile data, reconnecting the VPN, and changing split-tunnel settings. The Anti-Malware Testing Standards Organization (AMTSO) treats those as separate test states in its February 2025 VPN-testing guidance.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesBefore you start: make the comparison fair
- Use the same device, browser and network for the disconnected and connected measurements.
- Close pages that could be using a different browser profile, proxy or privacy extension.
- Record the VPN protocol, server or location and whether split tunneling is enabled.
- Note whether the ordinary connection has IPv6. A blank IPv6 result is meaningful only when you know IPv6 was available in the baseline.
- On Apple devices, check whether iCloud Private Relay is active in Safari. It can change the measured IP and DNS path independently of your VPN, so include its state in your notes.
- Use an independent or clearly described testing service when comparing configurations. A VPN provider’s own test page is operational guidance, not independent certification.
Run the complete leak-check sequence
1. Capture a disconnected baseline
- Disconnect the VPN completely. Wait for the client to show that it is disconnected rather than merely changing servers.
- Open an IP-check page in the browser you will use for all later tests.
- Write down the public IPv4 address, approximate region or network name shown, and whether the page reports IPv6.
- If the page or a separate IPv6 check reports an IPv6 address, record it. If it reports none, write “no IPv6 observed” rather than assuming the VPN will block IPv6.
This baseline is your reference. An address that is familiar from your home or mobile connection is expected while the VPN is off; it becomes a concern if the same public address is still visible after the VPN is connected.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
2. Check the public IP with the VPN connected
- Connect the VPN to a server and wait until the client reports an active tunnel.
- Return to the same IP-check page, or reload it in the same browser profile.
- Compare the connected result with the baseline. The visible public address should represent the VPN route rather than simply repeat the ordinary connection’s address.
An unchanged baseline address is a reason to investigate the VPN’s connection state, routing, firewall or split-tunnel exclusions. It does not, by itself, prove that every process is exposed: the test may cover only that browser request, and a client can have unusual routing rules. Treat it as a failed check for the tested browser path until you understand the difference.
3. Run a DNS-specific test
- Keep the VPN connected.
- Open a DNS leak-testing page rather than relying on the ordinary IP page.
- Run the test and record every resolver organization, hostname and address it reports.
- Repeat the same DNS test with the VPN disconnected if you did not already capture a baseline.
Compare the resolver information with your ordinary network and with the VPN’s documented DNS design. A DNS test may show several resolvers; note all of them and whether they belong to the expected VPN path, your internet provider, a workplace network or another service. Do not infer DNS behavior from the public IP alone. AMTSO recommends selecting an appropriate DNS tool and explaining what it measures, because a page that reports only the web request’s address is not a DNS test.
4. Test WebRTC in the browser that matters
- Leave the VPN connected and open a WebRTC leak-testing page in the exact browser used for sensitive browsing.
- Allow the page to run its normal WebRTC discovery test.
- Separate any public address from private or local-network addresses in the output.
- Compare a public address with both your disconnected baseline and the connected VPN address.
A private address such as one used inside your home network is not the same finding as exposure of your ordinary public address. A public baseline address appearing in WebRTC output while the VPN is connected deserves investigation even if the ordinary IP page shows the VPN address. WebRTC IP handling is specified separately from ordinary page loading; RFC 8828 explains why this path requires its own check.
Free tools Windows power users keep installed
One-click scans. No signup required.
5. Check IPv6 independently
- With the VPN connected, use an IPv6-capable test or an IP page that clearly reports IPv6.
- Compare the result with the disconnected baseline.
- Interpret the outcome against the VPN’s documented IPv6 behavior: native IPv6 support, tunneling, blocking or no stated support.
Changing the visible IPv4 address does not establish that IPv6 traffic is covered. If your ordinary connection had a public IPv6 address and the connected test still shows that same address, IPv6 traffic may be bypassing the VPN. If neither state reports IPv6, the test cannot demonstrate IPv6 protection; it only shows that no IPv6 address was observed in those conditions.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
6. Repeat the states that can change the result
For a stronger diagnosis, repeat the IP, DNS, WebRTC and IPv6 checks after each material change:
- Switch to a different VPN server and wait for the tunnel to re-establish.
- Move between two Wi-Fi access points.
- Switch from Wi-Fi to mobile data or back.
- Disconnect and reconnect the VPN after sleep, restart or a temporary network loss.
- Turn split tunneling off, then on, and note which applications are excluded.
- Test another browser or a non-browser application if your concern includes traffic beyond the browser.
AMTSO identifies VPN connection transitions, server changes, network changes, WebRTC, IPv6 and split-tunnel behavior as distinct cases. A clean result in one connected state does not cover all of them.
How to interpret each result
| Check | What it observes | Expected connected result | Concern requiring investigation |
|---|---|---|---|
| Public IP | The address used by the tested web request | Different from the disconnected baseline and consistent with the VPN route | The ordinary public address remains visible, or results vary unexpectedly between reloads |
| DNS | Resolvers that answer the browser’s hostname lookups during the test | Resolvers match the VPN’s documented behavior or an intentionally configured private resolver | Your internet provider, workplace or another unexpected resolver appears while connected |
| WebRTC | Addresses discoverable through the browser’s WebRTC mechanisms | No disconnected public address is exposed; private local addresses are interpreted separately | Your ordinary public address appears in WebRTC output |
| IPv6 | Whether IPv6 traffic has a visible path outside the expected tunnel | IPv6 is covered according to the VPN’s design, or no IPv6 exists in either baseline or connected state | The disconnected public IPv6 address remains visible while connected |
What different leak patterns usually mean
The public IP is unchanged
First confirm that the client is actually connected and that the page was reloaded after connection. Check whether the browser or operating system is using a manually configured proxy, a corporate gateway or a split-tunnel rule that excludes the browser. Disconnect and reconnect the tunnel, then test another server. If the baseline address persists in every connected state, treat the browser route as unprotected and consult the VPN client’s routing or kill-switch documentation before sending sensitive traffic.
The public IP changes, but DNS shows your ordinary resolver
This is a DNS-path problem, not an IP-page failure. The VPN may be routing web traffic through its tunnel while leaving DNS on the operating system’s existing resolver, or the browser may be using its own encrypted-DNS setting. Check the browser’s secure-DNS configuration, the operating system’s DNS settings and any split-tunnel exclusions. Retest after changing one setting at a time so you can identify which component controls the resolver list.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
The IP page is clean, but WebRTC shows a public baseline address
The browser’s WebRTC behavior is exposing a path that ordinary page loading did not use. Confirm that the address is public and matches the disconnected baseline, not merely a private address from your local network. Review the browser’s WebRTC and privacy controls, VPN browser-extension settings and any documented WebRTC handling, then run the test again in the browser used for real activity. A different browser can produce a different result, so do not generalize one browser’s output to all applications.
IPv4 changes, but IPv6 remains visible
Your connection has two address families and only one is being redirected, blocked or tested. Confirm that IPv6 was present in the disconnected baseline. If it was, look for a VPN setting that supports or disables IPv6 and for operating-system routes that remain active outside the tunnel. Until the behavior is understood, avoid assuming that an IPv4-only result hides your connection from services that can use IPv6.
Results change during connection or server switching
Short transition windows can expose traffic while the client tears down one route and creates another. Test immediately after connecting, after the client reports a stable tunnel, and during a deliberate server change. A kill switch may block traffic during transitions, while a split-tunnel configuration may intentionally keep selected applications outside the VPN. Record the exact timing and application rather than combining transition results with stable-state results.
Keep a test record that is useful later
A small log prevents you from confusing one network state with another. Record the date, platform, browser version, VPN protocol, server, network type and split-tunnel setting alongside each result.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
| State | Public IPv4 | Public IPv6 | DNS resolvers | WebRTC public address | Notes |
|---|---|---|---|---|---|
| VPN off, network A | Record exact result | Record address or “none observed” | Record resolver names and addresses | Record public/private findings | Browser, platform and time |
| VPN on, server A | Record exact result | Record exact result | Record every resolver | Record public/private findings | Protocol and split-tunnel state |
| VPN on, server B | Record exact result | Record exact result | Record every resolver | Record public/private findings | Whether the tunnel was re-established |
| VPN on, network B | Record exact result | Record exact result | Record every resolver | Record public/private findings | Wi-Fi or mobile-data change |
Use “not observed” when a test returns no address. Do not convert an absent result into a claim that the path is blocked or protected unless the baseline establishes that the path existed and the VPN’s documented behavior explains the outcome.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Browser tests versus a full traffic audit
A browser test shows what that test page can observe from one browser process. It does not inspect every packet from background services, update agents, messaging applications, virtual machines or other users on the device. It also may not exercise traffic excluded by split tunneling or traffic generated during a reconnect.
An advanced evaluation uses traffic inspection and deliberately tests stable connection, server switching, network switching, WebRTC, IPv6 and split-tunnel states. Most readers do not need packet capture to perform a useful first check, but they should describe browser results accurately: “this browser showed the VPN address and these resolvers in this state,” not “the device is guaranteed leak-free.”
Apple devices and iCloud Private Relay
Safari on Apple devices can use iCloud Private Relay, which changes how IP and DNS requests are relayed. If it is enabled, a baseline taken in Safari may already include a privacy relay, and a connected result may combine that relay with the VPN. Establish the relay state before comparing results. To isolate the VPN, use a controlled configuration in which you know whether Private Relay is enabled, and report the browser and feature state with your findings.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Choosing and reporting test tools
Independent pages that expose separate IP, DNS and WebRTC results are useful because each test has a defined purpose. BrowserLeaks, for example, provides separate pages for those categories; use the page that matches the question rather than treating its IP page as a substitute for its DNS or WebRTC checks. AMTSO’s February 2025 guidance emphasizes stating the tool choice and test scope.
Vendor-authored instructions can explain how a particular client is intended to behave, but they are not neutral certification. When comparing two configurations, use the same independent test, browser, platform and network, and disclose any setting that changed. RFC 8828 is the relevant IETF specification for WebRTC IP-address handling; it explains why WebRTC deserves a separate observation from an ordinary web request.
A concise decision checklist
- Baseline captured: VPN off, same browser and network, public IPv4 and IPv6 availability recorded.
- IP path checked: VPN on, connected result differs from the ordinary public address.
- DNS path checked: Resolver list came from a DNS-specific test, not an IP page.
- WebRTC path checked: Public addresses were separated from private local addresses.
- IPv6 path checked: The result was compared with the baseline’s IPv6 availability.
- Transitions tested: At least one server or network change was checked if the risk warrants it.
- Scope recorded: Device, browser, platform, protocol, server, network and split-tunnel state are documented.
When to stop using the connection
Do not use a connection for activity that depends on VPN privacy while your ordinary public address, an unexpected DNS resolver or a disconnected public IPv6 address is still appearing in the relevant connected-state test. Save the results, verify the client’s routing and split-tunnel settings, and retest after each change. If the behavior persists across servers and networks, contact the VPN provider with the exact browser, platform, protocol, server, timestamps and outputs; those details are more actionable than a general claim that “the VPN leaks.”
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
