What the proxy leak test checks
Six checks, each comparing one channel with the address websites see over HTTP. A leak is any channel that leaves from a different network.
| Check | What it catches | How it's measured |
|---|---|---|
| Exit IP | What it catchesThe address, network and IP type every site sees. | How it's measuredYour browser asks our server which address the request came from. We look up its network (ASN) and location. |
| WebRTC | What it catchesA second public or local address that any page can read with JavaScript. | How it's measuredYour browser collects WebRTC candidates from our STUN server, and we compare each public one with your exit IP. |
| UDP | What it catchesBrowsers that only rewrite the address they report, and UDP or TCP that skips the proxy. | How it's measuredYour browser contacts our TURN server over UDP and TCP with a one-time token. Our server records where those packets came from. |
| HTTP/3 (QUIC) | What it catchesUDP traffic that leaves outside a TCP-only proxy. | How it's measuredOur server answers over HTTP/2 and HTTP/3 and reports which protocol and address each request used. |
| IPv6 | What it catchesIPv6 traffic routed around an IPv4 proxy. | How it's measuredYour browser fetches an address that only resolves over IPv6. |
| Timezone | What it catchesA browser clock that doesn't fit the IP's location. | How it's measuredWe compare your browser's UTC offset now with the timezone of your exit IP. |
How the test works
Your exit IP comes first
Every other check is compared with the address our server sees on a normal HTTPS request.
WebRTC runs against our own servers
Your browser asks our STUN server for its public address, then tries our TURN server over UDP and TCP with a one-time token. We refuse the relay and only record where the request came from.
HTTP/3 gets a fair chance
The first request uses TCP and learns that HTTP/3 is available. The probe then closes that connection, so the browser can try QUIC over UDP, and our server reports which one arrived.
Addresses are matched by network
We look up the network (ASN) behind each address. The same address passes, a sibling address on the same carrier is a note, and a different network is a leak.
Why our server checks, not just your browser
A WebRTC leak test that only reads what the browser reports can be fooled. Anti-detect browsers rewrite the address in their WebRTC candidates, so the test shows your proxy IP while the packets still leave from your own connection.
Sites that care, such as ad platforms, marketplaces and social networks, can run their own STUN and TURN servers and look at where packets really arrive from. This test does the same. When the address your browser reports and the address our server sees differ, the result says so.
Different IPs on a mobile network aren't always a leak
Mobile carriers place thousands of subscribers behind a shared pool of public addresses (carrier-grade NAT). One phone's TCP and UDP traffic can leave from two neighbouring addresses in the same pool. Sites see both as the same carrier, so this test reports a sibling address on the same network as a note, not a leak. How carrier-grade NAT shapes mobile proxies.
When to run it
- Before you log in to accounts in an anti-detect browser profile, to confirm WebRTC, timezone and IPv6 match the proxy.
- After you change proxy settings, browser flags or extensions.
- When a scraper or browser bot gets blocked although every request goes through a proxy.
- When you resell proxies and want to show a buyer what a site sees.
How to fix each leak
- WebRTC
- Set the browser or profile to send WebRTC only through the proxy, or use a proxy that carries UDP so WebRTC can go through it.
- UDP and HTTP/3
- Use a proxy that carries UDP over SOCKS5, or turn off QUIC in the browser so it stays on TCP. How SOCKS5 carries UDP and HTTP/3.
- IPv6
- Turn off IPv6 on the device or network adapter, or use a proxy that carries IPv6 traffic.
- Timezone
- Set the profile's timezone to the proxy's location. Most anti-detect browsers can take it from the proxy IP.
- Datacenter IP
- Sites with strict anti-bot checks distrust hosting networks. A mobile proxy leaves on a carrier network instead. Compare mobile proxy prices.
Proxy leak test questions
What is a proxy leak?
A proxy leak is any traffic or browser setting that shows a website something other than your proxy's address. The common ones are WebRTC revealing your real IP, UDP traffic such as HTTP/3 skipping a TCP-only proxy, IPv6 traffic routed outside an IPv4 proxy, and a browser timezone that doesn't match the proxy's location.
How do I run a WebRTC leak test?
Open this page with your proxy or browser profile active. The test starts on its own and compares the addresses WebRTC exposes with your exit IP. If WebRTC shows an address on another network, the result marks it as a leak and explains how to fix it.
Why does a proxy leak test check UDP?
Most HTTP and SOCKS5 proxies forward TCP only. Browsers also send UDP: WebRTC uses it for calls and HTTP/3 runs on QUIC over UDP. If that UDP leaves through your own connection, sites see your real address even though every page load went through the proxy.
How is this different from other WebRTC leak tests?
Most tests only read the addresses the browser reports. This one also runs its own STUN and TURN servers, records where UDP and TCP packets really arrive from, checks HTTP/3, IPv6 and timezone, and compares networks rather than single addresses, so sibling addresses on a mobile carrier aren't reported as leaks.
My WebRTC IP is different but on the same carrier. Is that a leak?
No. Mobile carriers share pools of public addresses between subscribers, so one device's traffic can leave from two neighbouring addresses. Both belong to the same network, and sites see the same carrier. The test reports this as a note.
Can an anti-detect browser pass a WebRTC test and still leak?
Yes. Masking only changes the address the browser reports. If the packets still leave from your own connection, a site's server sees the real one. The server-verified check catches exactly this case.
Does the test save my IP address?
No. Results aren't saved or linked to an account. To show the network and location, our server looks the address up with an IP data provider and keeps that lookup in memory for a few hours.
Do ProxyStream proxies carry UDP?
Advanced servers carry UDP over SOCKS5, so HTTP/3 and WebRTC can run through the proxy instead of around it. Standard servers carry TCP. If you have a ProxyStream proxy, sign in and test it from our server on this page.