ClientSideTools Privacy-First Browser Tools

WebRTC Local IP Leak Detector & Sanitizer

Check whether your browser exposes local network addresses through WebRTC and generate practical mitigation guidance.

Privacy, Security & Web APIs Local processing The test runs locally and does not use external STUN servers.

Detector

Detection controls

Ready. Detection runs locally and does not contact external STUN servers.

Detected candidates

    Outputs

    Introduction

    WebRTC enables real-time communication in the browser, but ICE candidate gathering can expose local network addresses in some browsers and configurations. This can be a privacy concern on shared or untrusted networks.

    This detector runs a local peer-connection test and shows what candidate information your browser produces.

    How it works

    The tool creates a local RTCPeerConnection with no STUN servers, generates an offer, and listens for ICE candidates. It then classifies each candidate and explains whether private or public address information appears.

    • No external STUN or TURN servers are used.
    • No media stream is requested.
    • The connection is closed after the test.
    • Addresses can be masked in the UI and report.

    How to use

    1. Choose a timeout.
    2. Decide whether addresses should be masked.
    3. Click Start local detection.
    4. Review detected candidates and privacy findings.
    5. Copy mitigation guidance if needed.

    Practical example

    If the test shows a host candidate such as 192.168.1.xxx, your browser is exposing a private IPv4 address through local WebRTC candidate gathering. If the candidate shows an obfuscated mDNS hostname instead, the browser is limiting raw IP exposure.

    Use cases

    • Checking browser privacy posture.
    • Verifying whether mDNS obfuscation is active.
    • Auditing WebRTC exposure before using shared networks.
    • Testing browser extensions or privacy settings.
    • Documenting privacy behavior for internal reports.

    Best practices

    • Keep browsers updated.
    • Use a VPN on untrusted networks.
    • Review browser privacy settings for WebRTC.
    • Avoid disabling WebRTC if your applications depend on it.
    • Re-test after changing settings or extensions.

    Common mistakes

    • Assuming a VPN hides local WebRTC candidates in every browser.
    • Disabling WebRTC without checking application impact.
    • Relying on a single test without rechecking after updates.
    • Assuming no candidates means permanent protection.
    • Sharing unmasked reports containing local network details.

    Limitations

    • WebRTC behavior varies by browser, OS, and network.
    • Some browsers obfuscate candidates or restrict candidate gathering.
    • This tool does not test remote STUN or TURN exposure.
    • Results represent the current browser profile and settings only.

    Browser compatibility

    The tool requires RTCPeerConnection. Current Chromium and Firefox browsers often support it, while privacy restrictions and candidate obfuscation may vary.

    FAQ

    Does this tool contact external servers?

    No. It uses a local WebRTC connection and does not use external STUN servers.

    Why are some addresses masked?

    Masking is enabled by default to reduce the chance of accidentally sharing local network details when copying reports.

    Does no result mean I am fully protected?

    Not necessarily. It means the local test did not detect candidates. Browser policies, permissions, or timing can affect results.

    Can websites run this automatically?

    This tool requires a user-initiated action. Browser privacy controls and permissions may also limit what websites can do with WebRTC.

    References

    Version and changelog

    • Version: 1.0.0
    • Last updated: August 8, 2026
    • Changelog: Initial production release.