WebRTC leak

A page opens a peer connection and the browser starts listing every way it could be reached. Each way arrives as a line of text the page simply reads.

1. 1

   Opens a connection

   One line of script is enough, and there is no prompt and nothing visible on the page.

2. 2

   Collects the candidates

   The browser starts with the addresses on your own network, because those are the cheapest route.

3. 3

   Hands them to the page

   Every candidate line reaches the script, which keeps the addresses and moves on.

• The address on your network

  Something like 192.168.1.5. It belongs to the network rather than the profile, so it is identical across every profile on the machine.

• A hidden name

  A long name ending in .local, which a modern browser offers in place of the real address. It changes, so nothing can be joined up by it.

• The address seen from outside

  What the far side would answer on. This is the one that ought to belong to the proxy rather than to you.

What a site sees follows the profile's WebRTC mode. In the default mode, Proxy address, a profile with a proxy is started with a rule forbidding the browser to step around the proxy to gather addresses, so the site sees none of yours.

No UDP keeps the same rule on every profile, and until the ARMANOS Browser update My address and Off work as No UDP. Real lifts the rule on purpose, and an extension with the privacy permission can lift it too: Chrome ranks an extension's setting above the launch line.

The built-in engine sets the rule on every window of the profile in every mode except Real, so a profile is not left uncovered on a machine where the ARMANOS engine is not installed yet.

The leak check on this site runs inside the browser you are reading this in and prints the addresses it hands out. There is no request to anywhere, and the page keeps nothing.

It cannot tell you whether your real address differs from your exit. That comparison needs a server collecting visitors' addresses, and a privacy tool doing that would be the very thing you came here to avoid.

The app measures that part on your own computer. Network > Run diagnostics starts the engine your profiles open with, behind a stand-in proxy, and tells you whether WebRTC sent a request past it.

• DNS leak

  There the names of sites go out to your own resolver. None of it shows up in the candidate list.

• Switching WebRTC off

  A browser that refuses every call is rarer than any address in the list, so the refusal becomes the identifying trait. Off is still there as a mode for a profile that never makes calls.

• An extension that hides them

  A patch at page level leaves the browser gathering the addresses anyway. The launch rule keeps them from being gathered at all.