WebRTC leak

The address of your machine on its own network is the same for every profile on that computer. A site that collects it ties those profiles to each other, whatever proxy each one was given.

A WebRTC leak is a browser handing a site the addresses of your own network while it sets up a call.

How the addresses get out

A page opens a peer connection and the browser starts listing every way it could be reached. Each way arrives as a line of text the page simply reads.

1
Opens a connection
One line of script is enough, and there is no prompt and nothing visible on the page.
2
Collects the candidates
The browser starts with the addresses on your own network, because those are the cheapest route.
3
Hands them to the page
Every candidate line reaches the script, which keeps the addresses and moves on.

Three kinds of address in one list

The address on your network
Something like 192.168.1.5. It belongs to the network rather than the profile, so it is identical across every profile on the machine.
A hidden name
A long name ending in .local, which a modern browser offers in place of the real address. It changes, so nothing can be joined up by it.
The address seen from outside
What the far side would answer on. This is the one that ought to belong to the proxy rather than to you.

What the engine does at launch

The browser is started with a rule forbidding it to step around the proxy to gather addresses. A profile then sees what its proxy sees and nothing besides.

The same rule is set on the window of the built-in engine, so a profile is not left uncovered on a machine where the ARMANOS engine is not installed yet.

What our free check can tell you

The leak check on this site runs inside the browser you are reading this in and prints the addresses it hands out. There is no request to anywhere, and the page keeps nothing.

It cannot tell you whether your real address differs from your exit. That comparison needs a server collecting visitors' addresses, and a privacy tool doing that would be the very thing you came here to avoid.

Often confused with

DNS leak
There the names of sites go out to your own resolver. None of it shows up in the candidate list.
Switching WebRTC off
A browser that refuses every call is rarer than any address in the list, so the refusal becomes the identifying trait.
An extension that hides them
A patch at page level leaves the browser gathering the addresses anyway. The launch rule keeps them from being gathered at all.

What this does not do

Our free check does not compare your real address with your exit. That needs a server holding both, and this site does not run one.
It does not read your DNS. The check measures the addresses this browser hands out during call setup, and nothing about name resolution.
It does not switch WebRTC off. A browser unable to place a call at all is a rarer thing than any single address it might reveal.
It does not undo a link that already exists. Two profiles that once handed out the same address on your network stay joined afterwards.

Check it

Both halves of this page, the rule and the check, come from files you can open.

The rule the engine is started with: apps/desktop/src/lib/forkEngine.js
A real address is called a leak and a hidden name is not: apps/desktop/test/leak-verdict.js
The free check makes no request of its own: apps/web/test/тест-утечки.js
What the check reads in your browser: apps/web/components/tools/LeakCheck.tsx

Questions

Is a .local name a leak?: No. That is the browser hiding the real address behind a name that changes, and calling it a leak would be a false alarm.
Does incognito close it?: No. Incognito clears storage when the window closes, while the candidate list is gathered fresh on every call.
Does a VPN close it?: A VPN changes where the traffic goes. The browser still gathers the address of your machine on its own network, and that address still reaches the page.
Why does one address tie my profiles together?: Because it belongs to the network and not to the profile. Ten profiles behind ten proxies report the same one, and that is a single line to join them by.
How do I see mine?: Open the leak check linked below. It reads this browser, names what it found, and sends none of it anywhere.

Next to this

Read this browser right now

The free check lists the addresses this browser hands out through call setup, with nothing sent anywhere.

Open the leak check Download ARMANOS