How to Check If Your VPN Is Working: The 4 Leak Tests That Prove It (IP, DNS, WebRTC, Kill Switch)
CodexFuse Team · 2026-10-27T17:28:04.830Z · 16 min read
Your VPN says connected — but is it really working? Run four quick leak tests (IP, DNS, WebRTC, kill switch) and know for sure in five minutes.
Learning how to check if your VPN is working takes about five minutes, and it is the only way to know your privacy tool is doing its job. Your VPN app can show a green "Connected" status while your real IP address, your DNS requests, or your location are still leaking out behind the scenes. The icon only confirms that the app opened a session with a server. It says nothing about which IP address websites can see, where your DNS queries go, or whether your real IP would slip through if the connection dropped. Run the four leak tests below — IP, DNS, WebRTC, and kill switch — and you will have proof instead of a feeling. Start with our free IP address lookup to see what the internet currently sees about your connection, and if you are still setting things up, read our guide on how to use a VPN first.
How do I know if my VPN is working?
Your VPN is working when three things are true: websites see your VPN server's IP address instead of your real one, your DNS requests travel through the VPN tunnel instead of to your internet provider, and your kill switch cuts all traffic if the connection drops. A changed IP alone is not proof — your DNS can still leak while your IP looks hidden. Check all three with this 30-second test:
- With your VPN connected, open an IP-check page. The location shown should be your VPN server's city, not your real city.
- Run a DNS leak test. Every server in the results should belong to your VPN provider, not your home internet provider.
- Toggle your Wi-Fi off and back on, then reload the IP check immediately. If the page errors out or still shows the VPN server's IP, your kill switch held.
If all three pass, your VPN is working. If any step fails, the full tests below will show you exactly which part is leaking and how to fix it.
First, record your baseline before you test anything
Before running any test, record what your connection looks like with the VPN off. This baseline is mandatory, because without it a "different" result proves nothing — you need something to compare against.
Disconnect your VPN completely, then open an IP-check page and write down three things: your public IP address, the city and country it shows, and the name of your internet provider. Then open a DNS leak test and note which DNS servers appear. Screenshot both pages if that is easier. Now connect to a VPN server in another city or country and run every test again against these notes. Every result in this guide is judged against your baseline, not against what looks familiar.
Test 1: Is your IP address actually hidden?
An IP leak happens when websites can still see your real IP address instead of only your VPN server's IP. This is the most fundamental check, because if it fails, nothing else matters — websites and advertisers can still identify your region and your internet provider.
With your VPN off, visit an IP-check page such as whatismyipaddress.com and note your real IP, location, and provider. Then turn your VPN on, connect to a server in another city or country, and refresh the same page. You should now see a different IP address, the VPN server's location, and either your VPN provider's name or a data-center label. If any of your original information still appears — especially your real location or provider name — your VPN is not working properly. Try disconnecting and reconnecting, switch to a different server, and test again. Also check whether split tunneling is enabled in your VPN settings: if the browser you are testing in is excluded from the tunnel, it will show your real IP even while the VPN protects your other apps.
A quick real-world check works too. Open a website that changes its content by location. If you are supposedly connected to a server in Japan but the site still shows your local version, your IP is not being masked.
Test 2: Is your DNS leaking to your ISP?
A DNS leak is the most common way a VPN can look connected while still exposing your activity. DNS is the system that translates a website name like "example.com" into the numeric address your device connects to. When it leaks, those lookups go to your internet provider's DNS servers instead of your VPN's — so your provider can see every website you visit, even though your IP address looks hidden.
Connect your VPN, then go to dnsleaktest.com and run the Standard Test. The results should show only your VPN provider's DNS servers, or a privacy-focused resolver your VPN routes through, such as Cloudflare or Google Public DNS. If you see your home provider's servers listed, your DNS is leaking. Run the Extended Test as well if you want to check for IPv6 DNS exposure. To fix a leak, open your VPN app's settings and turn on DNS leak protection (it may be called "Use VPN DNS only" or "Custom DNS"), then reconnect and test again. If it still fails, check whether your operating system has a custom DNS server configured — a system-level DNS override bypasses the VPN's protection no matter what the app setting says. Also check your browser: modern browsers have a Secure DNS (DNS over HTTPS) feature that can bypass your VPN's DNS routing, so turn it off or point it at your VPN's DNS provider.
Test 3: Is WebRTC exposing your real IP?
WebRTC is a browser feature that powers video calls and real-time collaboration, and it can bypass your VPN tunnel entirely. A WebRTC leak exposes your real IP address to websites even when everything else is encrypted, which matters most if you use browser-based meeting tools such as Zoom, Google Meet, or Microsoft Teams in the browser.
With your VPN connected, open the WebRTC test at browserleaks.com/webrtc and look at the "Public IP Address" and "Local IP Address" fields. The test passes when the public IP shown is your VPN server's IP and your real public IP appears nowhere. Seeing a local address that starts with 192.168, 10, or 172.16 to 172.31 is normal — those are private network addresses that do not reveal your public IP. If the test shows your real public IP, you have a WebRTC leak. Many VPN apps include WebRTC leak protection you can enable in settings. In Firefox, you can also disable WebRTC directly: type "about:config" in the address bar, search for "media.peerconnection.enabled", and set it to false — but note that browser-based calls will stop working until you turn it back on. In Chrome or Edge, a WebRTC control extension does the same job, and the Brave browser blocks WebRTC leaks by default.
Test 4: Is IPv6 traffic bypassing the tunnel?
Many networks now use IPv6, the newer internet addressing system, but some VPNs only protect IPv4 traffic. An IPv6 leak happens when your device uses IPv6 to connect while your VPN protects only IPv4, letting websites see your real IPv6 address and location. Check whether your connection even has IPv6 with our free IPv6 address lookup tool.
With your VPN connected, run a leak test that shows both IPv4 and IPv6, such as ipleak.net or test-ipv6.com. You should see only your VPN server's IP address for both versions — or no IPv6 result at all, because many VPNs simply disable IPv6 entirely. If you see two addresses — your VPN's IPv4 address plus a different IPv6 address that reveals your real location or provider — you have an IPv6 leak. Reconnect and test again; if it persists, update your VPN app and check its IPv6 or leak protection settings. Some VPN clients also let you disable IPv6 at the operating-system level, forcing all traffic through IPv4 where your protection works. If your provider cannot protect IPv6 at all, that is a real reason to consider a different provider.
Test 5: Does your kill switch actually fire?
A kill switch is only useful if it actually fires, and the only way to know is to simulate a dropped connection and watch what happens. A kill switch blocks all internet traffic if the VPN connection drops unexpectedly, so your device never quietly falls back to your real IP. Test it safely: connect your VPN, open an IP-check page in a tab, and confirm it shows your VPN server's IP. Then toggle your Wi-Fi off for three seconds and turn it back on. The moment Wi-Fi reconnects, reload the IP-check page immediately, before the VPN has time to reconnect. If you see a connection error, a blank page, or the same VPN server IP, the kill switch held. If the page loads and shows your real IP, the kill switch did not fire.
Two warnings matter here. First, do not use the Disconnect button in your VPN app for this test — many VPNs treat an intentional disconnection differently and restore your regular connection, so the kill switch never triggers. Switch servers or protocols instead, or use the Wi-Fi toggle above. Second, this test applies to standalone VPN apps only. Browser extension VPNs do not have a kill switch, so if you use one, skip this test and focus on the first four. And never expose real traffic on purpose during a test — the Wi-Fi toggle method keeps the exposure window to a few seconds with no sensitive activity running.
How to read your VPN test results
Judge each result against the baseline you recorded, not against whether a server name looks familiar. An unfamiliar server name is not automatically a leak — your browser's Secure DNS setting or a split-tunneling rule can change the names you see. Use this table to score your VPN:
| Test | Pass | Fail |
|---|---|---|
| Public IP | Shows the VPN server's IP and location | Shows your baseline public IP |
| DNS leak | Shows your VPN provider's DNS servers | Shows your regular provider's DNS servers |
| WebRTC | Shows only the VPN server's public IP | Shows your baseline public IP |
| IPv6 | Baseline IPv6 disappears or follows the VPN route | Shows your baseline public IPv6 address |
| Kill switch | Traffic stops during the drop | Your real IP appears during the drop |
All five pass and your VPN is genuinely protecting you. One fails and you have a specific problem with a specific fix — not a reason to panic or immediately switch providers. Three or more fail, and the VPN is not doing its job at all.
What to do when a test fails
Failing one test does not mean your VPN is broken. Each failure type has a specific fix, so work through the one that matches what you saw:
| Failure | Most likely cause | Fix to try first |
|---|---|---|
| IP does not change | Tunnel did not establish, or split tunneling excludes the browser | Reconnect, switch servers, check split-tunneling exclusions, clear the browser cache |
| DNS leak | DNS leak protection off, or a system-level DNS override | Enable DNS leak protection, remove custom OS-level DNS, disable browser Secure DNS |
| WebRTC leak | Browser exposing the real IP through video-call channels | Enable WebRTC protection in the VPN app, or disable WebRTC in Firefox settings |
| IPv6 leak | VPN protects IPv4 only | Update the app, enable IPv6 protection, or disable IPv6 at the OS level |
| Kill switch does not fire | Kill switch is off by default, or the app lacks permissions | Turn the kill switch on in settings, then reinstall with full network permissions if needed |
If a fix does not work, restart your device before testing again — cached DNS information and network routing tables can hold a leak in place after you change a setting. If the same test keeps failing after every fix, the problem is the provider, not your setup. That is the point at which switching VPNs is the honest answer. It is also worth remembering why testing matters at all: in 2024, the FTC banned Avast from selling user data it allegedly collected without consent and fined the company $16.5 million, after users believed they were gaining privacy while their browsing habits were being monetized. A privacy tool is only as good as its configuration — testing is the only proof.
How to check if your VPN is working on iPhone, Android, Windows, and Mac
The four leak tests work the same way in any browser on any device. The steps below cover how to confirm the VPN is actually connected on each platform before you run them.
On iPhone
Look for the small "VPN" label in your status bar when a connection is active. For a fuller check, go to Settings, then General, then VPN and Device Management, then VPN — your provider should show "Connected" under its name. Then open Safari, visit an IP-check page, and confirm the location matches your VPN server, not your real city. One thing to watch: iOS can reconnect to a VPN silently after an interruption without telling you the connection dropped, so always confirm with the IP check rather than the status screen. If leaks persist, toggle the VPN off and on, disable Private Relay, then retest.
On Android
Pull down the notification shade. If your VPN is active, you will see a key icon and a VPN notification. You can also go to Settings, then Network and Internet, then VPN to see the connection status. Open Chrome and run the IP and DNS tests. The same warning applies as on iPhone: the system indicator tells you the connection state, not whether the tunnel is routing your traffic correctly. If issues appear, disable Smart DNS, Data Saver, or Private DNS modes, then retest.
On Windows and Mac
On Windows, look for your VPN app's icon in the system tray, then go to Settings, then Network and Internet, then VPN — your provider should show "Connected". On Mac, check the menu bar for your provider's icon, then go to System Settings, then Network, then VPN — your connection should show a green dot and "Connected". Open any browser, run the IP, DNS, WebRTC, and IPv6 tests in sequence, and repeat them in a second browser you use regularly. A browser extension VPN only protects the browser it is installed in, so a second browser showing your real IP is expected — not a leak.
How often should you test your VPN?
Run the full four-test ladder the first time you set up a new VPN, and again any time you switch servers, update the app, or change devices. After that, a monthly routine is enough for most people: reconnect to your usual server, run the IP and DNS checks, and confirm the kill switch is still enabled in settings. Also retest whenever you change networks — especially when you switch between Wi-Fi and mobile data on a phone, or join a new public Wi-Fi network, where you should complete the network's sign-in page before connecting the VPN.
One more check people confuse with a failure: speed. Run a speed test with the VPN off, note the download speed and ping, then connect and repeat the test using the same speed test server. Some decrease in speed and a higher ping are normal when a VPN is working — encryption, server distance, and the protocol all cost performance. What matters is whether the connection stays stable and fast enough for what you are doing. Frequent disconnects, large ping swings, or failed reconnections are the real problems, and they point at the server, the protocol, or the network — not at the leak tests. If you want the background first, our explainer on what is a VPN covers how the tunnel actually works.
Sources
- McAfee — "How to Check If Your VPN Is Working" (mcafee.com/learn/how-to-check-if-your-vpn-is-working-properly/) — five-test method, per-device troubleshooting steps, FTC Avast $16.5 million fine in 2024, Secure DNS bypass warning.
- Internxt — "How to Check if Your VPN Is Working: 4 Tests [2026]" (blog.internxt.com/how-to-check-if-your-vpn-is-working/) — 30-second quick check, four-test ladder, kill-switch Wi-Fi toggle method, browser extensions have no kill switch, Firefox about:config WebRTC fix.
- CyberGhost VPN — "Is My VPN Working? How to Check Your VPN" (cyberghostvpn.com/privacyhub/is-my-vpn-working/) — baseline-then-compare method, eight-test sequence, private address ranges 192.168/10/172.16–172.31, never test with the Disconnect button, speed-test comparison method.
- SetApp — "How to check if your VPN is working properly" (setapp.com/how-to/test-vpn-connection) — five-test summary table, ipleak.net, browserleaks.com/webrtc, test-ipv6.com.
All sources were fetched and read in full on October 27, 2026. Test-site names (whatismyipaddress.com, dnsleaktest.com, browserleaks.com, ipleak.net, test-ipv6.com) are given as the tools the cited guides themselves recommend.
Frequently asked questions
Is my VPN working if my IP address changed?
A changed IP address means your browser traffic reached the VPN server, which is a good sign — but it is not full proof. Your DNS requests can still leak to your internet provider while your IP looks hidden, and WebRTC can still expose your real IP in the browser. Run the DNS and WebRTC tests as well before calling it done.
What is a DNS leak test?
A DNS leak test shows which DNS servers handle your website lookups. You run it at a site like dnsleaktest.com while your VPN is connected. If the results show your home internet provider's servers, your DNS is leaking — your provider can see every site you visit. If they show only your VPN provider's servers, or a privacy-focused resolver your VPN routes through, your DNS is protected.
Can a VPN leak my real IP through WebRTC?
Yes. WebRTC is a browser feature for video calls and real-time collaboration, and it can bypass the VPN tunnel and reveal your real public IP to websites. Test it at browserleaks.com/webrtc with your VPN connected. If your real public IP appears, enable WebRTC leak protection in your VPN app, disable WebRTC in Firefox settings, or use a browser that blocks WebRTC leaks by default.
How do I test my VPN kill switch safely?
Connect your VPN, open an IP-check page, and confirm it shows your VPN server's IP. Then toggle your Wi-Fi off for three seconds and turn it back on. Reload the IP-check page immediately. If it errors out or still shows the VPN server's IP, the kill switch held. Never use the Disconnect button in your VPN app for this test — most VPNs restore your regular connection on purpose when you disconnect manually.
Why is my VPN slow even when it is working?
Some slowdown is normal. Encryption, the distance to the VPN server, network congestion, and the protocol you use all cost speed and add ping. Compare a speed test with the VPN off against one with it on, using the same speed test server. A modest drop is expected. Frequent disconnects, large ping swings, or failed reconnections are the real warning signs — try a closer server or a different protocol before blaming the VPN itself.