Start with the public IP
Check and save your normal IP before enabling the VPN. Connect the VPN, refresh the test and compare the address, ASN and location. If they changed to the VPN provider's expected network, the main web path is likely using the VPN.
Check WebRTC
Browsers can expose ICE candidates during peer-to-peer setup. Modern privacy protections often hide or obfuscate local addresses, but checking the candidates can reveal whether an unexpected public route appears.
Check IPv6
A VPN can handle IPv4 correctly while IPv6 follows another path if configuration is incomplete. The IPv6 test checks whether the browser can reach an IPv6-capable public-IP service and what address family is visible.
DNS requires a different test
A genuine DNS leak test needs infrastructure that can observe which recursive resolver asks for a unique test domain. Browser JavaScript alone cannot reliably enumerate the resolver addresses, which is why we do not fabricate a DNS “pass” result.
A changed IP is not total anonymity
The VPN changes network routing, not every possible identifier. Continue to use normal browser, account and device security.
What a successful basic test looks like
After connection, the public IP should usually differ from the baseline and the new ASN or organization should match the VPN route you intended to use. If only the number changes but the network still belongs to your ordinary ISP, investigate further.
Why a full check uses several signals
Public IP, IPv6, WebRTC and DNS each test a different part of the networking stack. A VPN can pass one check while another path behaves unexpectedly, which is why a before-and-after multi-signal test is more useful than one green badge.