How to check whether your VPN is working: 7 tests for leaks, kill switch and speed

A VPN that says "Connected" is not always protecting you. The app can show a green shield while your real IP address, your DNS requests or a browser feature called WebRTC quietly reveal who and where you are. The good news is that checking takes about five minutes and costs nothing.

This guide walks through seven tests in the order you should run them: a baseline, an IP check, a DNS leak test, a WebRTC test, an IPv6 test, a kill switch test and a speed test. For each one you will learn what a pass looks like, what a fail looks like, and the exact setting to change when something leaks.

Quick answer: how to tell if your VPN is working

Disconnect the VPN and note your real IP address and internet provider. Connect to a server in another country, then visit a leak test site such as ipleak.net. Your VPN is working if all of the following are true:

• The IP address shown belongs to the VPN server, not your provider.
• The location matches the country you picked in the app.
• No DNS server from your internet provider appears in the list.
• The WebRTC section does not show your real public IP.
• Your IPv6 address is hidden or replaced by the VPN.
• When the VPN drops, the kill switch blocks traffic instead of falling back to your normal connection.

If one of these fails, jump to the fix section for that test below.

Why a VPN can look connected and still leak

A VPN creates an encrypted tunnel between your device and a server run by the provider. Websites see the server's IP address instead of yours. But your device does several things outside that tunnel unless the app is configured to stop them:

• DNS lookups: Turning a name like example.com into an address. If these go to your provider's resolver, your provider sees every site you visit.
• WebRTC: A browser technology for video calls that can ask STUN servers for your public address and expose it to web pages.
• IPv6 traffic: Many VPNs only tunnel IPv4. If your network also has IPv6, some traffic can skip the tunnel entirely.
• Reconnect gaps: When the connection drops or you switch networks, apps keep sending data. Without a kill switch, that data uses your normal connection.

These are the four leak types every test below is designed to catch. Good providers block all of them by default, but settings, browser extensions, operating system quirks and router setups can still undo that protection.

The 7 VPN tests at a glance

Test 1: Record your real IP address (the baseline)

You cannot spot a leak unless you know what your real details look like. With the VPN switched off, open ipleak.net and write down three things:

• Your public IPv4 address.
• Your public IPv6 address, if one is shown.
• The DNS servers listed, which usually carry your internet provider's name.

Keep this note open. Every later test compares against it. If any of these exact values appears while the VPN is connected, you have a leak.

Test 2: Check your IP address and location

Now connect the VPN. For a clear result, pick a server in a different country from the one you are in, because a server in your own city can make the location look almost the same.

1. Open the VPN app and connect to a server abroad.
2. Refresh ipleak.net in a fresh browser tab.
3. Compare the IP address with your baseline note.
4. Check that the country and city match the server you chose.

Pass: The IP is different from your baseline and the provider name is the VPN company or a data center, not your home ISP.

Fail: You still see your own IP. This usually means the tunnel did not start, the browser is excluded by split tunneling, or a proxy extension is overriding the VPN. Disconnect, reconnect, and check the split tunneling list in the app settings.

A small note on location: IP databases are not always accurate, so a server in Amsterdam sometimes shows as another Dutch city. That is normal. What matters is that your real IP is gone. If streaming services still see the wrong country, see our guide on fixing a streaming VPN error.

Test 3: Run a DNS leak test

A DNS leak is the most common problem and the easiest to miss, because the IP check in test 2 can pass while DNS still goes to your provider. Use dnsleaktest.com and choose the Extended test, which sends several rounds of lookups and catches leaks the standard test can miss.

Pass: Every server listed belongs to the VPN provider or to a neutral resolver it uses. None of them carry your internet provider's name.

Fail: Your ISP's name appears anywhere in the results, even once.

How to fix a DNS leak

• Turn on DNS leak protection or "use VPN DNS only" in the app settings, if it is not already on.
• Remove any custom DNS you set in your network adapter or router, such as a manual resolver entry.
• In Chrome, Edge or Firefox, turn off secure DNS (DNS over HTTPS) with a fixed provider, or set it to use your current provider, so the browser does not bypass the tunnel.
• On Windows, a feature that sends DNS requests over every network adapter can cause leaks. Updating the VPN app usually handles it, and our Windows 11 VPN guide covers the settings in detail.

Run the extended test again after each change until your ISP disappears from the list.

Test 4: Check for WebRTC leaks

WebRTC lets browsers run video calls without plugins. To connect two people, it asks STUN servers for your public address, and a web page can read the result with a few lines of script. On a poorly configured setup, that reveals your real IP even while the VPN is on.

Open browserleaks.com/webrtc with the VPN connected and look at the public IP field.

Pass: Only the VPN IP, or no public IP at all, is shown. Local addresses such as 192.168.x.x or 10.x.x.x are fine because they are private and do not identify you on the internet.

Fail: Your baseline public IP appears.

How to fix a WebRTC leak

• Install your provider's browser extension. Most major providers include a WebRTC block option.
• In Firefox, open about:config and set media.peerconnection.enabled to false. Note that this also breaks browser video calls.
• In Chrome and Edge there is no built in switch, so use a trusted extension that limits WebRTC to the proxied connection.
• Make sure the browser is not excluded by split tunneling, which would route WebRTC outside the tunnel.

Test 5: Check for IPv6 leaks

If your provider supports IPv6, your device may have both an IPv4 and an IPv6 address. Some VPNs only tunnel IPv4, so any site reachable over IPv6 sees your real IPv6 address. Visit test-ipv6.com with the VPN on.

Pass: Either no IPv6 address is detected, or the IPv6 address belongs to the VPN provider.

Fail: The page shows the same IPv6 address you recorded in the baseline, or names your home provider.

How to fix an IPv6 leak

• Enable IPv6 leak protection in the VPN app. Many apps block IPv6 completely while connected.
• Choose a provider that supports IPv6 inside the tunnel, so you keep full connectivity.
• As a last resort, disable IPv6 on the network adapter or router. This works but can affect some services on your local network.

Test 6: Test the kill switch

A kill switch blocks all internet traffic when the VPN connection drops, so nothing leaks during the gap. It only helps if it is turned on and actually works, so test it rather than trust the toggle.

1. Enable the kill switch in the app settings.
2. Connect the VPN and open ipleak.net.
3. Force the connection to drop. The safest ways are switching WiFi networks, turning WiFi off and on, or ending the VPN process in Task Manager or Activity Monitor.
4. Refresh the page straight away, several times.

Pass: Pages fail to load until the VPN reconnects, and ipleak.net never shows your baseline IP.

Fail: Even one refresh shows your real IP.

Note that clicking "Disconnect" in the app is not a valid test. Most kill switches assume a manual disconnect is intentional and let traffic through. You need an unexpected drop.

Kill switch options by platform

For Mac specific steps, including the system extension prompts that can affect the kill switch, see how to install a VPN on macOS.

Test 7: Measure the speed impact

A working VPN always costs some speed, because data is encrypted and travels to the server first. The question is whether the drop is reasonable. Run a speed test with the VPN off, then connect to a nearby server and run it again.

As a rough guide, a well run service on a nearby server usually keeps most of your download speed, while a server on another continent costs much more because of distance. A large drop on a nearby server points to the protocol or a busy server rather than a broken VPN.

• Switch to WireGuard or the provider's own WireGuard based protocol.
• Try another server in the same city.
• Test on a wired connection to rule out weak WiFi.
• Pause cloud backups and large downloads while testing.

If you game or host a media server, latency and open ports matter more than raw speed. Our explainer on VPN port forwarding covers when you need it.

What each failed result means

Testing a VPN on phones, TVs and routers

The same tests work on any device with a browser. On Android and iPhone, open the test sites in your mobile browser while connected. Test on both WiFi and mobile data, because the switch between them is the moment most leaks happen.

Streaming sticks are harder because the browsers are limited. On a Fire TV, the Silk browser can load ipleak.net, which is enough for the IP and DNS checks. Our guide on setting up a VPN on a Fire TV Stick covers the app side.

For a VPN router, test from any connected device. If the router tunnel is working, every device should show the VPN IP. If one device shows your real IP, check whether it uses its own private DNS or a separate network band that bypasses the VPN.

How often should you test?

Running the full set once is not enough, because updates change behavior. Repeat the tests in these situations:

• After installing a new VPN or switching providers.
• After a major app or operating system update.
• After installing a new browser or privacy extension.
• When you change routers or start using a new network often, such as a new office or travel WiFi.
• Before something sensitive, such as using public WiFi abroad. People living overseas should test on each new network, as we explain in our guide for expats.

Which VPNs pass these tests by default

In current versions, the major providers block DNS, WebRTC (through their extensions) and IPv6 leaks out of the box and include a kill switch. Settings and defaults still differ, so test your own setup.

• NordVPN: Uses its own DNS servers, includes a kill switch on desktop and mobile, and its NordLynx protocol is based on WireGuard.
• Proton VPN: Open source apps that have been independently audited, a kill switch with a stricter permanent mode, and a strong free plan for testing.
• Surfshark: Private DNS on every server, a kill switch and unlimited simultaneous connections for testing every device.
• ExpressVPN: Runs its own DNS on each server and calls its kill switch Network Lock.

For a ranked list with speed, privacy and pricing compared, see our best VPN guide. If you mainly use a desktop, our pick of the best VPN for PC focuses on Windows features.

Common mistakes when testing a VPN

• Skipping the baseline. Without your real details, you cannot tell a leak from a normal result.
• Testing in a tab opened before connecting. Old pages can show cached results, so always refresh or open a new tab.
• Treating local IPs as leaks. Addresses starting with 192.168, 10 or 172.16 to 172.31 are private and safe.
• Using the app's Disconnect button for the kill switch test. It needs an unexpected drop.
• Only testing one browser. Extensions and DNS settings differ between browsers, so test each one you use.

For broader advice on choosing a trustworthy service, the Electronic Frontier Foundation's guide to choosing a VPN is a good independent read.

Frequently asked questions

How do I know if my VPN is on?

Check the app status, then confirm it with an IP check. If a site like ipleak.net shows an IP and location that belong to the VPN server instead of your provider, the tunnel is active.

Can a VPN leak my IP address?

Yes. DNS requests, WebRTC, IPv6 traffic and connection drops can all expose your real IP if the app is not set up to block them. The leak tests in this guide catch all four.

Is a DNS leak serious?

For privacy, yes. Your provider or whoever runs the DNS server can see every domain you visit, even though the content of your traffic stays encrypted.

Why does the VPN show the wrong city?

IP location databases are often slightly off. If the country is right and your real IP is hidden, the VPN is working.

Do free VPN leak test sites collect my data?

They see the IP and DNS details they test, which is how they work. Use well known sites and avoid entering any personal information.

Should I test my VPN on mobile data too?

Yes. Switching between WiFi and mobile data is when many leaks happen, so test both and enable Always on VPN where your phone supports it.