What WebRTC does in a browser
WebRTC supports direct audio, video, and data connections in browsers. Before two devices can communicate, the browser gathers possible network routes called ICE candidates. Those candidates can include local interfaces, addresses discovered through a STUN service, and relay routes supplied by a TURN service. The available candidates depend on the browser, network, and privacy settings.
This page creates a short-lived data connection without requesting camera or microphone access. It uses a STUN service to see which address the browser can present for connection negotiation. The peer connection is closed when candidate gathering ends or after the timeout. VeilVerify keeps the observed candidates in page memory only.
How to read the result
If the test sees a public WebRTC address that differs from the public IP loaded for the page, it reports another public address. That difference deserves attention when a VPN is active because the browser may be presenting a route outside the expected VPN exit. It can also happen on multi-homed networks, corporate systems, or connections with unusual address translation.
A matching public address is not automatically a problem. It means WebRTC presented the same public address already visible to the website. If no public candidate appears, the browser may be hiding it, using an obfuscated local hostname, blocking STUN, or simply following a route that did not return a public candidate during this short check.
Checking WebRTC while a VPN is active
Connect the VPN before loading this test. Confirm that the public IP belongs to the VPN location you selected, then compare the WebRTC result. Another public address associated with your normal provider may indicate that WebRTC traffic is leaving by an unexpected route. Repeat the test after changing VPN servers if the first result is unclear.
If another address appears, review the VPN application's leak-protection settings, update the browser and VPN client, and test again. Some browsers expose controls for WebRTC address handling, while managed browsers may follow an administrator policy. Avoid installing an unknown extension solely to change this behavior. Prefer documented browser or VPN controls.
Limits of a browser-based leak test
Browsers intentionally reduce address exposure over time. Local candidates may appear as temporary mDNS hostnames rather than numeric addresses, and some networks block the STUN request. A timeout means the page stopped waiting. It does not prove that WebRTC is disabled or that no other application can make a different connection.
The test observes one browser, one page session, and one STUN destination. It does not inspect DNS traffic, operating-system routes, other browsers, or native applications. Use it as a focused comparison rather than a complete network audit. A no-finding result is not a guarantee that every connection follows the expected path.