Free tool
IPv6 leak test
Many VPNs tunnel only IPv4. If your network also has IPv6 and the app does not block it, part of your traffic may leave the tunnel. This test checks whether that path is open.
Result
Running…
- IP our server sees
- –
- IPv6 connectivity
- –
- IPv6 address seen by a v6-only host
- –
How this test works
Your browser first asks our server which address it sees. It then tries to load a small response from a host that is reachable only over IPv6. If that request succeeds, your device has a working IPv6 path. When a VPN is on, that path should either go through the tunnel (the v6 address then belongs to the VPN) or be blocked entirely. If it succeeds with an address that is not the VPN's, IPv6 traffic is leaking around the tunnel.
What the result means
- IPv6 unreachable: either your network has no IPv6 or your VPN blocks it. No leak.
- IPv6 reachable and the address matches what our server sees: your VPN tunnels IPv6 properly. No leak.
- IPv6 reachable with a different address while the VPN is on: a leak. Sites with IPv6 can see an address your VPN does not cover.
How to fix an IPv6 leak
- Pick a VPN that handles IPv6. Providers either send IPv6 through the VPN or block it in the app. Our comparison table shows which do. The feature table on each review shows what the provider says it does.
- Windows: uncheck "Internet Protocol Version 6 (TCP/IPv6)" in the adapter properties, or use the provider's app setting that disables IPv6.
- macOS: System Settings, Network, your connection, Details, TCP/IP, set Configure IPv6 to "Link-local only".
- Linux: set
net.ipv6.conf.all.disable_ipv6=1with sysctl, or use a WireGuard config that includes::/0in AllowedIPs so IPv6 goes through the tunnel. - Router: disabling IPv6 on the router protects every device, at the cost of losing IPv6 entirely.
Privacy of this tool
The test makes two requests. The first goes to our own server, which reports the address it sees. The second goes to a host that only answers over IPv6, run by a third party called ipify. It learns your IPv6 address if you have one. We store nothing, and the third party sees only the request itself. If you would rather not contact an outside host, you can run the same check in a terminal. Look up a host that only has an IPv6 address and compare the result with your VPN's address.