Roughly one in three people who use a VPN have never checked whether it is actually doing its job. They install the app, see the green “Connected” badge, and assume the encryption is flowing. That badge only tells you the client thinks it is connected. It says nothing about whether your real IP address is exposed, whether your DNS requests are leaking to your internet provider, or whether your traffic will stay protected the moment the connection drops.
This guide walks through a practical, repeatable test routine. It covers what to check, how to interpret the results, and the mistakes that trip up even experienced users.
Why a “Connected” Status Is Not Proof of Protection
A VPN works in two separate ways, and both need testing. First, it must encrypt and tunnel your traffic. Second, your public IP address and apparent location must match the VPN server, not your home connection. A client can show “Connected” while failing on either count, especially after a network change, a sleep/wake cycle, or a botched update. (Best vpn 2025) (Virtual private network)
The most common failure modes are DNS leaks (your device sends domain lookups outside the tunnel), WebRTC leaks (your browser reveals your real IP through a peer connection), and kill switch failures (traffic escapes unprotected when the tunnel collapses). Each one has its own test.
Step 1: Confirm Your Real IP Before Connecting
Start by recording your baseline. Turn the VPN off completely, then visit an IP-check page or simply search “what is my IP” in a browser. Note the address and the reported location.
This baseline matters more than people expect. If you skip it, you cannot tell whether the VPN changed anything. A reader who once tested a “working” VPN discovered her IP had not changed at all, because the client had silently fallen back to a direct connection after a server timeout. The green badge was still on. (Decky loader not working steam deck fix 2026)
Write the baseline down. You will compare against it in the next step.
Step 2: Connect and Compare the IP
Turn the VPN on, wait for the connection to stabilize (ten to fifteen seconds is reasonable), then refresh the IP-check page. You want to see three things:
- A different public IP address than your baseline.
- A location matching the server you selected, not your home city.
- An ISP or organization field that names the VPN provider rather than your home broadband company.
If the IP is unchanged, the tunnel is not carrying your traffic. Disconnect, switch servers, and test again. If the location is wrong but the IP changed, you may have connected to a different server than you thought, which is usually harmless but worth knowing.
For anyone comparing providers before committing, it helps to understand the difference between a VPN and a proxy: a proxy typically reroutes traffic without encrypting it, so an IP change alone does not prove you have encryption.
Step 3: Run a DNS Leak Test
DNS is the internet’s phone book. When you type a domain, your device asks a resolver to translate it into an IP address. If those queries travel outside the VPN tunnel, your internet provider can see every site you visit even though your traffic itself is encrypted.
A DNS leak test works by showing which resolver answered your queries. Connect the VPN, run the test, and look at the listed resolvers. They should belong to the VPN provider or a public resolver routed through the tunnel. If you see your home ISP’s name, you have a leak.
Practical fixes that usually work:
- Enable the VPN client’s built-in DNS leak protection if it has one.
- Turn off “smart DNS” or split tunneling for the browser you are testing.
- Disable browser-level DNS-over-HTTPS temporarily, since it can bypass the tunnel’s resolver and produce confusing results.
- Reconnect and retest. Some leaks only appear on certain servers.
Results can differ between operating systems and browsers. A clean result in one browser does not guarantee a clean result in another.
Step 4: Check for WebRTC Leaks in Your Browser
WebRTC is the technology behind in-browser video calls. It can expose your real IP address to websites through a peer connection, even when a VPN is active. This is one of the sneakiest leaks because everything else can look perfect.
Open a WebRTC leak test page with the VPN connected. If the test shows your real IP alongside the VPN IP, the browser is leaking. Browser vendors document how WebRTC handles network interfaces, and the behavior varies by version and by whether the browser is using a proxy.
Mitigations include disabling WebRTC entirely in the browser settings, using a browser extension that blocks it, or switching to a browser with stricter defaults. For most people, disabling WebRTC when they are not on a call is the simplest fix.
Step 5: Verify the Kill Switch Actually Kills
The kill switch is the safety net. It should block all internet traffic if the VPN tunnel drops. Vendor claims about kill switches are common, but the only test that counts is the one you run yourself.
Here is a reliable method:
- Connect the VPN and confirm your IP has changed.
- Start a continuous ping to a public address in a terminal, or keep an IP-check page open with auto-refresh.
- Force the tunnel down. The cleanest way is to switch the VPN off at the operating system level, disable the network adapter the VPN uses, or briefly enable airplane mode and then disable the VPN before reconnecting.
- Watch whether traffic continues. If the ping keeps responding or the page keeps loading with your real IP, the kill switch failed.
Be careful with this test. On some systems, disabling the VPN through the client’s own interface intentionally restores normal traffic, which is not a kill switch failure. The real test is an unexpected drop. Simulating one is fiddly, which is why many people never bother. Do it anyway, at least once, on each device you rely on.
Step 6: Check for IPv6 and Other Leaks
Many VPNs tunnel IPv4 traffic but leave IPv6 untouched. If your ISP hands out IPv6 addresses, your device may communicate over IPv6 outside the tunnel while the VPN only protects IPv4. An IPv6 leak test will show whether this is happening.
The fix is usually to disable IPv6 on the device or in the VPN client, or to choose a provider with full IPv6 support. This is one of the most overlooked checks, and it is especially relevant on home networks with modern routers.
A Quick Comparison of the Main Tests
| Test | What it catches | How often it fails | Difficulty |
|---|---|---|---|
| IP comparison | Tunnel not carrying traffic | Common after network changes | Easy |
| DNS leak test | Resolver queries escaping the tunnel | Common with misconfigured clients | Easy |
| WebRTC test | Browser revealing real IP | Browser and version dependent | Easy |
| Kill switch test | Traffic escaping after a drop | Varies by OS and client | Moderate |
| IPv6 test | Unprotected IPv6 traffic | Common on modern home networks | Moderate |
Common Mistakes That Produce False Results
Several habits make people think their VPN is broken when it is fine, or fine when it is broken.
Testing only once. A VPN that passes every check today can leak tomorrow after an update or a Wi-Fi change. Retest after any change to your network, your client version, or your operating system.
Trusting cached pages. Browsers cache IP-check results aggressively. Always force a refresh or open a private window.
Testing with split tunneling on. Split tunneling deliberately routes some traffic outside the VPN. If you have it enabled for the app you are testing, a “leak” may be the intended behavior.
Ignoring the mobile device. Phones switch between Wi-Fi and cellular constantly, and that is exactly when leaks happen. Test on mobile too, especially if you use public networks.
Assuming a paid provider is automatically safe. Configuration matters more than price. Even a top-tier service can leak if DNS settings are wrong. If you are shopping around, reviews of the best VPN services can help you shortlist providers, but you still need to run the tests yourself.
How Often Should You Retest?
A sensible rhythm is monthly for everyday use, plus immediately after any of these events: a client update, an operating system update, a router change, joining a new Wi-Fi network, or traveling to a new country. If you rely on a VPN for sensitive work, weekly is not excessive.
Automation helps. Some clients offer built-in leak protection that runs continuously, and a few third-party tools can monitor your public IP and alert you if it changes unexpectedly. These are conveniences, not replacements for a manual check. (Use Strong Passwords)
What to Do If a Test Fails
Work through the problem in order. First, reconnect and try a different server. Second, check the client’s settings for DNS protection, kill switch, and IPv6 handling. Third, update the client and the operating system. Fourth, reinstall the client if problems persist. If none of that works, the provider’s support documentation is the next stop, and switching providers may be the honest answer.
One practical tip from people who test regularly: keep a short note of which server and protocol passed your last check. When something breaks, you have a known-good configuration to fall back to. That single habit saves hours.
For readers weighing options, guides to the best VPN and to free VPN options are useful starting points, though free tiers often limit the servers and protocols you can test.
Conclusion
Testing a VPN is not complicated, but it does require more than glancing at a green icon. Compare your IP before and after connecting, run a DNS leak test, check WebRTC in your browser, verify IPv6 behavior, and force a tunnel drop to confirm the kill switch works. Do this on every device, and repeat it after any change to your setup.
The payoff is simple: you stop assuming you are protected and start knowing it. That distinction is the whole point of using a VPN in the first place.
Frequently Asked Questions
How do I quickly check if my VPN is working?
Turn the VPN off and note your public IP address. Turn it on, wait a few seconds, and refresh the IP-check page. If the address and location changed to the VPN server’s, the tunnel is carrying your traffic. Then run a DNS leak test to confirm your queries are also protected.
What is a DNS leak, and why does it matter?
A DNS leak happens when your device sends domain lookups outside the VPN tunnel. Your internet provider can then see which sites you visit even though your traffic is encrypted. A DNS leak test shows which resolver answered your queries; it should be the VPN provider or a resolver routed through the tunnel.
Can a VPN show as connected but still leak my real IP?
Yes. This is common. The client’s status only reflects its own connection state, not whether traffic is actually routed correctly. WebRTC, IPv6, and misconfigured DNS can all expose your real address while the app displays “Connected.”
How do I test my VPN’s kill switch?
Connect the VPN, confirm your IP changed, then start a continuous ping or an auto-refreshing IP page. Force the tunnel to drop unexpectedly, for example by disabling the VPN’s network adapter. If traffic continues with your real IP, the kill switch is not working.
Do I need to test my VPN on my phone too?
Yes. Phones switch between Wi-Fi and cellular networks constantly, and those transitions are exactly when leaks occur. Run the same IP, DNS, and kill switch checks on mobile that you run on a laptop.
How often should I retest my VPN?
Monthly is a reasonable baseline for everyday use. Retest immediately after any client or operating system update, after changing routers or Wi-Fi networks, and when traveling. If you depend on a VPN for sensitive work, weekly checks are worth the few minutes.
