My VPN is on but the verdict says not masked. What happened?

Check three things in order. First, whether the client is genuinely connected rather than reconnecting. Second, whether split tunnelling excludes your browser. Third, whether a browser extension proxy is on while the system VPN is off, which routes only some requests. The address we show is the one the connection actually used.

Why does the verdict say partial leak when my VPN provider tool says everything is fine?

Most provider-run tests check only that the address changed. That is one of four things this page checks. The usual disagreement is IPv6: your provider tunnels IPv4, your ISP gives you IPv6, and the provider test never looks at IPv6.

Is a VPN detected flag on my address a problem?

Only for access. Some streaming services and banks block addresses classified as VPN or hosting. It has no bearing on whether the VPN protects you. If you need the flag gone you need a residential-classified address, which most commercial VPNs cannot give you.

Does this test prove my VPN provider does not log me?

No, and nothing on the open web can. This measures what leaves your device and where it goes. What your provider records after that is a question of contract, jurisdiction, and audit, not of measurement. Treat any tool that claims otherwise with suspicion.

How do I use the before-and-after mode?

Run the check with the VPN off, press snapshot, turn the VPN on, and run it again. The comparison shows which fields changed and which did not. A field that did not change while the address did is the leak, and it is far easier to see this way than from a single run.

Is My VPN Working?

Run four leak checks on WebRTC, DNS, IPv6 and address reputation, and get one verdict on whether your VPN covers your traffic.

Verdict

Running four checks…

WebRTC, DNS, IPv6 and the reputation flags run together. Rows fill in as each one lands.

Signal
Result
What it means
Address and network
216.73.216.7 · AS16509 Anthropic, PBC
The address and network this page arrived on. A VPN, proxy or relay should put its own network here, not your ISP.
WebRTC
Gathering ICE candidates…
Video-call plumbing can offer a second address straight from your machine. A leak here shows sites an address the tunnel was meant to hide.
DNS resolvers
Resolving six single-use names…
Every name your device looks up goes to a resolver. If your ISP resolver still answers while the tunnel is up, your ISP keeps the list of sites you visit.
IPv6 egress
Probing both address families…
Many VPN clients tunnel IPv4 and leave IPv6 on the ISP. When the two families leave through different networks, one of them is not covered.
Reputation flags
Not checked on this page
What address-reputation data says about this address. It is probabilistic, so the measured checks above outrank it.

Before and after

Snapshot this result, toggle the VPN, reload the page, then compare. The snapshot lives in this tab only and never reaches the server.

This page needs JavaScript. Three of the four checks run inside your browser: WebRTC candidate gathering, the DNS resolution of six single-use names, and the two single-stack probes. The server cannot do them for you.

What the verdict is built from

The verdict engine takes the four component results and applies a fixed rule set, which lives in packages/core and is covered by fixture tests. The order matters.

If the egress address is classified as an ISP network with no VPN, proxy, relay, or hosting signal, the verdict is not masked and the other checks are reported but do not change it.
Otherwise, if any component fails, the verdict is partial leak, and the failing component is named in the result.
Otherwise the verdict is VPN working.

A measured check outranks a reputation flag. Reputation databases lag behind new VPN ranges by days or weeks, and we would rather report what we observed than what a database guessed.

The disclosure

When the verdict is partial leak or not masked, this page shows an affiliate link to a VPN. We earn a commission if you buy through it. That link never appears on a VPN working verdict, and no part of the verdict logic is influenced by whether a link would render. The rule is enforced in the test suite rather than by convention. See the disclosure page for the full arrangement.

Limits

This measures your browser, from this device, right now. It says nothing about other applications on the same machine, other devices behind the same router, or what happens in the seconds after the tunnel drops. For the drop case, run the check, disconnect the VPN without stopping the client, and watch whether the address changes before the kill switch reacts.

About this tool

This page runs four checks and returns one verdict. It compares the WebRTC server-reflexive address against your connection address, identifies which resolvers answer your DNS, checks whether your IPv6 egress ASN matches your IPv4 one, and reads the reputation flags on your address. Before-and-after mode compares two runs, and a field that stayed the same while the address changed is the leak.

How to read the result

Verdict: VPN working: Your egress address belongs to a VPN or hosting ASN, WebRTC exposes no address outside it, the resolvers belong to the VPN or to a public service rather than your ISP, and your IPv6 egress ASN either matches the IPv4 one or you have no IPv6. No channel bypasses the tunnel.
Verdict: partial leak: The tunnel carries your HTTP traffic, but at least one channel goes around it, and the page names the failing check. The common cases are an IPv6 egress on the ISP ASN while IPv4 leaves through the VPN, ISP resolvers answering DNS, and a WebRTC srflx candidate on the physical interface.
Verdict: not masked: Your egress address belongs to a residential, mobile, or business ISP autonomous system, and no VPN, proxy, relay, or hosting classification applies. Either the VPN is off, it failed to connect, or it is configured to exclude this browser.
WebRTC component: Checks whether video-call technology gives away a second address, and it passes when no server-reflexive candidate exposes a public address different from the one on your HTTP connection. See /webrtc-leak-test for the candidate detail and the per-browser fixes.
DNS component: Checks whether your ISP still sees which domains you look up, and it passes when no resolver that queried our authoritative server belongs to your ISP autonomous system while the tunnel is up. See /dns-leak-test for the resolver list.
IPv6 component: Passes when the ASN announcing your IPv6 address matches the ASN announcing your IPv4 address, or when you have no IPv6. A mismatch means one family leaves the tunnel, which is the most common failure on VPN clients that predate dual-stack.
Reputation flags: What address databases think of your egress address, classified as vpn, proxy, tor, hosting, or relay and cached for 24 hours with a source and a timestamp. These are probabilistic, so a false negative on a fresh VPN range does not mean the VPN is failing, and the verdict weights the measured checks above the flags.

Questions people ask

My VPN is on but the verdict says not masked. What happened?: Check three things in order. First, whether the client is genuinely connected rather than reconnecting. Second, whether split tunnelling excludes your browser. Third, whether a browser extension proxy is on while the system VPN is off, which routes only some requests. The address we show is the one the connection actually used.
Why does the verdict say partial leak when my VPN provider tool says everything is fine?: Most provider-run tests check only that the address changed. That is one of four things this page checks. The usual disagreement is IPv6: your provider tunnels IPv4, your ISP gives you IPv6, and the provider test never looks at IPv6.
Is a VPN detected flag on my address a problem?: Only for access. Some streaming services and banks block addresses classified as VPN or hosting. It has no bearing on whether the VPN protects you. If you need the flag gone you need a residential-classified address, which most commercial VPNs cannot give you.
Does this test prove my VPN provider does not log me?: No, and nothing on the open web can. This measures what leaves your device and where it goes. What your provider records after that is a question of contract, jurisdiction, and audit, not of measurement. Treat any tool that claims otherwise with suspicion.
How do I use the before-and-after mode?: Run the check with the VPN off, press snapshot, turn the VPN on, and run it again. The comparison shows which fields changed and which did not. A field that did not change while the address did is the leak, and it is far easier to see this way than from a single run.

Last reviewed 2026-09-05.