Tools / Is My VPN Working?
Is My VPN Working?
You think
"VPN is on, I'm invisible."
The mirror
A VPN that leaks is worse than no VPN — you make decisions assuming you're safe.
The test runs in your browser and asks a Cloudflare STUN server for your public address — exactly what any web page can do. We don't see, store or log the result.
Testing…
Three checks run in your browser: IP masking, WebRTC and timezone. DNS has its own test.
What the three checks mean
IP masking. The address every website sees should belong to your VPN, not your home ISP. We recognise known VPN and hosting networks; a plain residential ISP means no VPN is carrying this traffic.
WebRTC leak. The browser can report your real public address outside the VPN tunnel to any page that asks. A different address is a leak. The full WebRTC test has the details →
Timezone. Your device's timezone should match where your IP appears to be. A mismatch is a red flag: the device is still telling sites where you really are.
DNS. Not checked on this page — it needs its own test. A pass here means "no leak found in these three checks", not "safe". Run the DNS Leak Test →
Synthesis
If it fails — free fixes first
Turn on the kill switch
In your VPN app's settings, enable the kill switch (sometimes called a firewall or network lock) so traffic stops if the tunnel drops instead of falling back to your normal connection.
Restrict WebRTC in your browser
Firefox: about:config → media.peerconnection.enabled → false. Brave: Settings → Privacy and security → WebRTC IP handling policy → "Disable non-proxied UDP".
Reconnect, then re-run the test
Reconnect the VPN, make sure it is the connection this browser uses, and run the test again. A VPN only counts if the test says so.
Changed something? Prove it.
Re-run the test after every change — the verdict above updates in place.
Questions
How does this test tell if my VPN is working?
It runs three checks in your browser: whether the address websites see belongs to a VPN or hosting network, whether WebRTC reveals a different address, and whether your device timezone matches your IP location. All three must pass for a "working" verdict.
Does this test check for DNS leaks?
Not on this page. DNS leaks have their own test, the DNS Leak Test. A pass here does not rule out a DNS leak.
Why does it say my VPN is leaking when it is on?
Common causes are WebRTC reporting your real address, a connection that dropped and reconnected without a kill switch, or traffic that is not routed through the tunnel. VPN detection is also heuristic: a VPN exiting from an unusual network can show up as "no VPN detected".
Does Digital Mirror store my result?
No. The test runs in your browser. The only request is one to this site that echoes your own connection details back, and nothing is stored on the server.
Checked your VPN? Hold the mirror up to the next belief
WebRTC Leak Test
You think: the VPN covers everything.
The mirror: WebRTC can hand out your real IP anyway.
Leak tests by VPN provider
You think: my provider is the safe one.
The mirror: check you are really on it — and that it holds.
Full Digital Mirror scan
You think: one leak, one problem.
The mirror: all findings in one reflection, scored.