who-r-u
Video calls in the browser use WebRTC, and any page can start it without asking. It asks a STUN server which address you came from, over UDP, which many VPNs and proxies don't carry. Here are the addresses WebRTC gives away, compared with the address sites see.
79 sniffers · no permission asked
You're probably from , and right now you're in . You speak , and your computer runs on with a clock.
You're on , using , with a screen and graphics: .
You get online through , ; the DNS server that looks up sites for you is in . .
You like , and . . Your fonts drop a hint: . As for your age, .
This is someone else's portrait.
What do sites make of you? It runs as soon as you open it, asks no permission and stores nothing.
Check mine
CF-Connecting-IPrequest.cf.cityrequest.cf.latituderequest.cf.asOrganizationedns.ip-api.comrequest.cf.timezoneDNS PTRrequest.cf.colorequest.cf.tlsVersion/cdn-cgi/trace · kex, sni/cdn-cgi/trace · warpTLS ClientHelloDate.now()RTCPeerConnection · STUNWebRTC host candidatemyip.ipip.netapi.ip.sbchatgpt.com/cdn-cgi/traceclaude.ai/cdn-cgi/tracewww.cloudflare.com/cdn-cgi/traceCloudflare Radar · IPv4 / IPv6User-AgentAccept-LanguageSec-CH-UASec-CH-UA-PlatformAccept-EncodingDNT · Sec-GPCReferer · document.referrernavigator.languagesIntl.DateTimeFormatIntl …timeZoneIntl …hourCycleIntl.Locale weekInfoIntl.NumberFormatnavigator.keyboardspeechSynthesisError.messagecanvas.toDataURLWebGL getParameterOfflineAudioContextfonts → SHA-256SHA-256canvas × 2userAgentDatauserAgentData.brands…architecture · bitnessscreen · devicePixelRatiorequestAnimationFramescreen.isExtended · screenXinnerWidth · availHeightWebGL RENDERERnavigator.gpu adapter.infoWebGL2 · MAX_TEXTURE_SIZEhardwareConcurrencynavigator.deviceMemorymaxTouchPoints · pointernavigator.getBatterynavigator.connectionenumerateDevicesAudioContext.sampleRatePublicKeyCredentialbluetooth.getAvailabilityMediaSource.isTypeSupportedrequestMediaKeySystemAccessstorage.estimateprefers-color-schemeprefers-reduced-motioncolor-gamut · dynamic-rangeprefers-contrast · forced-colorsdisplay-modedoNotTrack · GPCnavigator.cookieEnabledpermissions.querypdfViewerEnablednavigator.webdriverbait elementwindow.ethereum · DOM markshistory.lengthcanvas measureTextTo set up a call, WebRTC collects every address it could be reached at: the local ones on your network card, and the public one a STUN server sees. A page reads them with a few lines of script, no permission needed. If your VPN or proxy carries only the page's web requests, the STUN request goes out on your own line, and the page learns your real IP behind the VPN.
The page opens a WebRTC connection to the STUN servers of Cloudflare and Google and lists the addresses they report ("server reflexive" candidates), then compares them with the address this site, your other exits and the IPv6 test see. An address that none of them show is a leak. The local addresses come from the "host" candidates; nothing is stored or sent anywhere.
Proxy clients (Clash, V2Ray and others): turn on TUN mode so UDP goes through the proxy too. Chrome and Edge: the WebRTC Network Limiter extension, or uBlock Origin's "Prevent WebRTC from leaking local IP addresses". Brave: Settings → Privacy → WebRTC IP handling policy → Disable non-proxied UDP. Firefox: set media.peerconnection.ice.default_address_only to true in about:config, or media.peerconnection.enabled to false to turn WebRTC off. Then run this test again.
A name ending in .local is the browser hiding your local address (mDNS), which is what you want. A real local address such as 192.168.1.5 doesn't reveal where you are, but it makes your fingerprint more unique. An IPv6 address that differs from your IPv4 exit is a leak only if it isn't your IPv6 exit: the test checks it against the IPv6 address sites see.