Why "Connected" Doesn't Mean "Protected"
Most VPN apps show a simple connected/disconnected status, but that status only reflects whether the tunnel to the VPN server is active — not whether every category of your traffic is actually flowing through it. Certain requests, especially DNS lookups, WebRTC connections used by video calls, and IPv6 traffic, can slip outside the tunnel depending on your operating system, browser, and VPN configuration.
The IPv6 Leak Most People Miss
This is the gap that creates a false sense of security: most popular leak-checking tools only test IPv4 traffic and DNS resolution. If your VPN doesn't fully support or block IPv6, an IPv6-capable website can see your real network address directly, completely bypassing the VPN tunnel — while a basic IPv4-only check would report everything as fine.
Check your VPN for the two most common leak types, both in under a minute, without installing anything.
Run the DNS Leak Test → Run the WebRTC Leak Test →How to Actually Verify Your VPN
Confirming your VPN is doing its job takes three separate checks, not one glance at a status icon.
- Connect to your VPN and note the server location it reports.
- Run a DNS leak test — the results should show DNS servers matching your VPN provider, not your ISP.
- Run a WebRTC leak test — your browser should not reveal your real IP address alongside the VPN one.
- Check whether your VPN app has an IPv6 setting, and disable IPv6 system-wide if your VPN doesn't fully support it.
What a Real Leak Looks Like
A DNS leak was detected in this test typically shows up as DNS server addresses belonging to your internet provider instead of your VPN service, even while the VPN itself reports a successful connection. A WebRTC leak looks similar — your browser reveals a second IP address, your real one, alongside the VPN's IP, usually visible to any site running a basic WebRTC check.
Why This Matters More Than It Seems
The whole point of paying for or using a VPN is to hide your real IP address and browsing activity from your ISP, network operator, or the sites you visit. A leak quietly defeats that purpose while giving no visible warning — the VPN app still shows "Connected," the icon still looks normal, and nothing in the interface flags that a category of your traffic slipped outside the tunnel. This is exactly why a one-time visual check isn't enough on its own.
When Leaks Are Most Likely to Happen
Leaks aren't random. They cluster around specific moments: right after installing or updating a VPN app, right after switching servers or protocols, and after an operating system update that can quietly reset network settings. Building a quick check into those specific moments, rather than checking only when something feels wrong, catches most leaks before they become a habit.
Want a complete, repeatable list to run through every time you connect? A checklist format is faster than remembering each step.
Read: VPN Privacy Audit Checklist →For more background, see the Electronic Frontier Foundation (www.eff.org).
Frequently Asked Questions
How do I know if my VPN is actually working?
A VPN connection status icon only confirms the app is running, not that it's protecting your traffic. To actually verify it, run a DNS leak test, a WebRTC leak test, and check whether your IPv6 address is also being routed through the VPN.
Can a VPN show as connected but still leak data?
Yes. A VPN can successfully tunnel your main traffic while DNS requests, WebRTC connections, or IPv6 traffic bypass the tunnel entirely, exposing your real IP address or browsing activity without any visible warning.
What is an IPv6 leak?
An IPv6 leak happens when a VPN only routes IPv4 traffic and ignores IPv6, letting an IPv6-capable site or app see your real network address directly. Many popular leak checks only test IPv4 and DNS, missing this entirely.
How often should I check my VPN for leaks?
It's worth checking after every VPN app update, after switching servers or protocols, and periodically during regular use, since a leak was detected in some cases only after a routine app update changed default settings.
What's the difference between a WebRTC leak and a DNS leak?
A DNS leak exposes which websites you visit, because domain lookup requests bypass the VPN tunnel. A WebRTC leak exposes your real IP address directly, through a browser feature used for video calls. They're separate leak types with separate fixes, and a VPN can be protected against one while still exposed to the other.