What this privacy test checks
The combined diagnostic compares several browser-visible network signals: the public IP used to reach this site, WebRTC candidates exposed by the browser, an IPv6-capable request path and available VPN, proxy or Tor classifications.
These tests answer different questions. The public IP shows the main web-facing route, WebRTC can expose additional networking candidates, IPv6 can reveal a separate public path, and intelligence services classify the network endpoint. Reading them together is more useful than relying on one badge.
How to use it when testing a VPN
Run the test once before connecting and note your normal public IP and network. Connect the VPN, reload the page and run it again. The expected result is usually a different public IP associated with the VPN route, without an unexpected public WebRTC or IPv6 path that bypasses what you intended.
What this test cannot prove
A clean browser diagnostic does not prove complete anonymity. Websites can still use accounts, cookies, browser characteristics and application data. Network-intelligence classifications can also contain false negatives or false positives.
Why DNS is handled separately
A genuine DNS leak test requires observing which recursive resolvers make unique DNS requests. Ordinary browser JavaScript cannot reliably enumerate that infrastructure, so the DNS page opens a resolver-observation service instead of inventing a browser-only result.
How to interpret unexpected results
If you see an address that does not belong to the network you expected, check its ASN and full IP report before assuming it is a leak. A VPN may intentionally provide IPv6, browsers may expose private or mDNS WebRTC candidates, and network routes can differ by protocol.