IPv6 Leak Test

An IPv6 leak can occur when traffic takes a route outside the VPN protection you expected. This tool checks IPv4 and IPv6 connectivity visible to your browser and looks for IPv6 addresses exposed through WebRTC. Use the results as clues, not as proof that an entire device is protected or exposed.

Takes about 5-10 seconds

How to use it

Run the test once before connecting your VPN, then again while connected. Compare the browser-visible public IPv4 and IPv6 address families and network providers. A result that appears to show your original ISP connection during a VPN session is worth investigating. Do not post your full addresses in a public forum.

What this test measures

We use IPv4-only and IPv6-only web requests and attempt WebRTC address detection. An ASN is an organization/network attribution, not a measurement of which path a packet traveled. Some browser and OS traffic is outside the scope of these probes.

If an IPv6 result is unexpected

Confirm whether your VPN documents IPv6 handling, try the same test with the VPN disconnected and reconnected, and consult your VPN's support documentation. Do not disable IPv6 on an entire device or router as a universal first step; that can affect connectivity, and the diagnostic result alone does not justify it.

Privacy

These checks necessarily expose network addresses to the web endpoints that answer the test. We do not claim that no address or diagnostic metadata is ever logged unless the deployed endpoint, hosting configuration and retention policy have been verified.

Using an Android VPN?

Zend2 VPN is a live Android app. Its published policy describes an IPv4 full tunnel while connected and does not claim universal IPv6 leak protection, a verified no-logs audit, or a kill switch. See Zend2 VPN or get Zend2 VPN on Google Play.

Frequently asked questions

An IPv6 leak can occur when traffic takes a route outside the VPN protection you expected. This tool checks IPv4 and IPv6 connectivity visible to your browser and looks for IPv6 addresses exposed through WebRTC. Use the results as clues, not as proof that an entire device is protected or exposed.

No. If this test did not observe a usable IPv6 address from your browser on these probes, that does not prove all IPv6 traffic is blocked or that every app is protected. Recheck if your network or VPN configuration changes. A failed endpoint, blocked probe or timeout is inconclusive, not a pass.

No. If the observed IPv4 and IPv6 addresses are attributed to the same ASN or network, that match does not establish that IPv6 used your VPN tunnel. An ASN is an organization or network attribution, not a measurement of which path a packet traveled.

No. If the observed IPv4 and IPv6 addresses are attributed to different ASNs or networks, and you expected both connections to use the same VPN path, investigate further. This comparison alone cannot confirm a leak. A VPN's intended IPv4 and IPv6 network layout is unknown to this browser tool.

WebRTC can expose an IPv6 address during this check. Compare its network attribution with your expected VPN configuration. Exposure does not by itself establish that your original ISP address was disclosed. Seeing no WebRTC IPv6 address does not prove WebRTC cannot expose one later.

Confirm whether your VPN documents IPv6 handling, try the same test with the VPN disconnected and reconnected, and consult your VPN's support documentation. Do not disable IPv6 on an entire device or router as a universal first step. The diagnostic result alone does not justify that change.

Related checks

Zend2 is coming soon on the App Store

Zend2 is available on Google Play. We are still preparing the App Store release.

Get notified for iOS