Check if your VPN is leaking your real IP

To check if your VPN is leaking your real IP, run curl ipconfig.io/json with the VPN off, note your IP, country, and ISP, then connect the VPN and run it again — if any of those still match your real values, the VPN is leaking. A VPN is supposed to replace every detail of your public identity with the VPN server's. When ipconfig.io still reports your real address, home country, or ISP, traffic is escaping the tunnel.

Maintained by the ipconfig.io team · Reviewed 17 June 2026

This is a real diagnostic you can run in under a minute from any terminal. ipconfig.io returns exactly what a website sees about your connection, so comparing the "off" and "on" results tells you precisely what your VPN is and isn't hiding.

What does it mean when a VPN "leaks" your IP?

A VPN leak is any request that reaches the internet outside the encrypted tunnel, exposing your real IP address, location, or ISP. When a VPN works correctly, every connection appears to come from the VPN server: a different IP, a different country, and a different network operator. A leak means one or more of those slipped through with your real details attached.

The clearest tell is your ISP. The asn_org field in ipconfig.io reports the organization that owns the IP you're connecting from. With the VPN on, that should be the VPN provider's network — not your home internet provider. If asn_org still shows your real ISP, that request never went through the tunnel.

Leaks usually come from one of a few causes: the VPN dropped momentarily, IPv6 was never tunneled, or split-tunnel rules sent some traffic around the VPN.

How do I test my VPN for IP leaks with curl?

Compare ipconfig.io's output with the VPN off versus on. Follow these steps.

1. Disconnect the VPN. Then capture your real identity:

   curl ipconfig.io/json

   Note three fields: ip (your real public IP), country (your real country), and asn_org (your real ISP).

2. Connect the VPN and run the exact same command again:

   curl ipconfig.io/json

3. Compare the two records. All three values should change. The ip should be the VPN server's address, country should be the server's country, and asn_org should be the VPN provider's network. If any one of them still matches your "off" result, that's a leak.

If you only want the headline answer, the bare endpoint returns just your current public IP as plain text:

curl ipconfig.io

Run that with the VPN on and off — if the IP doesn't change, the VPN isn't routing your traffic at all.

To inspect a specific field rather than the full record, use the dedicated endpoints:

curl ipconfig.io/country-iso   # two-letter country code
curl ipconfig.io/asn-org       # the network operator (your ISP or the VPN's)

How do I check if my VPN is leaking my IPv6 address?

Force each protocol family and compare. The single most common VPN failure is tunneling IPv4 while your real IPv6 address escapes — so test both explicitly:

curl -4 ipconfig.io   # what the world sees over IPv4
curl -6 ipconfig.io   # what the world sees over IPv6

With the VPN connected, both should return a VPN address. If curl -6 returns your real IPv6 address while curl -4 shows the VPN, you have an IPv6 leak: your IPv4 is protected but every IPv6 connection reveals your true location.

This matters more than it used to. Roughly 50% of users now reach Google over IPv6 (Google, 2026), so an IPv6 leak isn't a corner case — it can expose your real address on a large share of your everyday traffic.

If curl -6 returns an error or nothing, your network simply has no IPv6 connectivity, and there's nothing to leak over IPv6. That's fine.

Is a DNS leak the same thing?

No — a DNS leak is a separate problem this test does not cover. ipconfig.io checks the IP path: the address, country, and ISP that a server sees on your connection. A DNS leak is different — it exposes which DNS servers resolve your domain lookups, which can reveal your activity to your ISP even when your IP is fully hidden.

A VPN can pass this IP test cleanly and still leak DNS. Treat them as two distinct checks. This guide confirms your IP path is sealed; a dedicated DNS-leak test confirms your lookups go through the tunnel too.

What should a clean result look like?

Every identifying field changes to the VPN's values, on both IPv4 and IPv6. A leak-free result looks like this when you compare the two runs:

• ip — changes from your real address to the VPN server's
• country / country_iso — change to the VPN server's country
• asn_org — changes from your ISP to the VPN provider's network
• hostname — typically resolves to the VPN provider's reverse DNS, if any

If all of these change for both curl -4 and curl -6, your VPN is not leaking your IP. If even one field holds your real value, you've found the leak.

Which VPN should I use?

A leak-free VPN needs a verified no-logs policy, because hiding your IP from websites is pointless if the provider records it instead. Proton VPN is one example — Swiss-based, independently audited, and no-logs. (Affiliate link; it helps keep ipconfig.io free. Use any no-logs provider you trust.)

Frequently asked questions

How do I check if my VPN is leaking my real IP? Run curl ipconfig.io/json with the VPN off and note your IP, country, and asn_org (your ISP). Connect the VPN and run it again. If the IP, country, or ISP still match your real values, the VPN is leaking. Repeat with curl -4 and curl -6 to catch IPv6 leaks.

What is an IPv6 VPN leak? An IPv6 leak happens when a VPN tunnels your IPv4 traffic but lets IPv6 traffic bypass the tunnel, exposing your real IPv6 address. Test it by running curl -6 ipconfig.io while connected. If it returns your real IPv6 address instead of the VPN's, your IPv6 is leaking.

Is a DNS leak the same as an IP leak? No. An IP leak exposes your real IP address on the connection path, which is what ipconfig.io detects. A DNS leak exposes which DNS servers resolve your domain lookups, which is a separate test. A VPN can pass the IP test and still leak DNS, so check both.

Why does ipconfig.io still show my real ISP with the VPN on? The asn_org field reports the organization that owns the IP address you are connecting from. If it still shows your home ISP while the VPN is on, your traffic is not going through the tunnel for that request, which means the VPN is leaking.

Next steps

• Find your ISP from your IP — understand exactly what the asn_org field reveals about your network.
• IP geolocation with curl — read country, city, and coordinates from the command line.
• Find your public IP from the terminal — the one-line commands behind this test, explained.