How to Test a VPN: Leaks, Speed and Kill Switch

Choosing a VPN is easy to do on trust and hard to do on evidence. Marketing pages promise privacy, speed and reliability, but you do not have to take any of it on faith. A handful of free tests, most of which take a few minutes, will tell you whether a VPN really hides your IP address, keeps your DNS queries inside the tunnel, stays quiet when it drops, and runs fast enough for what you do.

This guide is a method, not a ranking. It works for any VPN, including one you already use and one you are about to try. Run the checks in the order below, write down what you see, and you will have your own evidence. The same steps are the sensible alternative to reading another person's review: your device, your network and your usage are what matter. If you only want the short version, the help guide on checking whether your VPN is working covers the essentials.

Set up a fair baseline first

Every test compares two states, so you need a baseline before you connect. Spend two minutes on this and the rest of the process becomes meaningful.

1. Disconnect the VPN and restart the browser. Make sure no VPN, proxy or extension is running.
2. Note your public IP address. Search for "what is my IP" using any reputable lookup site. Write down the IPv4 address and, if shown, the IPv6 address.
3. Note your DNS servers. Open a DNS test page and record which resolvers it reports. These are usually your internet provider's or your router's.
4. Measure your normal speed. Run a speed test three times and note download, upload and latency (also called ping). Latency is the time a small message needs to travel to a server and back; Cloudflare's explanation of latency is a good short read.
5. Record the context. Which device, which network (home Wi-Fi, mobile data, office), and what time of day. These details explain odd results later.

Keep these numbers in a note or spreadsheet. Everything that follows is a comparison against them.

Check for IP and IPv6 leaks

The first and simplest test: does the website see your real address?

1. Connect to the VPN and wait until the app shows it as connected.
2. Open an IP lookup page again. The IPv4 address should differ from your baseline and should belong to the VPN network, not your internet provider.
3. If the page also shows an IPv6 address, check it. IPv6 is the newer version of the internet addressing system, described in RFC 8200. Many home and mobile networks now offer it. A VPN that only handles IPv4 can leave IPv6 traffic running outside the tunnel, which would show your real IPv6 address.
4. Use a test page that checks both IPv4 and IPv6. If your baseline had an IPv6 address and the connected result still shows it, you have an IPv6 leak.

What counts as a pass: every address shown while connected is different from your baseline, or IPv6 is clearly blocked or tunnelled. What counts as a fail: any address from your baseline appears while connected. If you see a leak, try updating the app, switching the connection method if the app offers one, and retesting. If the leak remains, do not rely on that setup for anything sensitive.

Check DNS and WebRTC leaks

Your IP address is not the only thing that can escape. Two other places deserve their own tests.

DNS. Every time you visit a site name, your device asks a DNS server to translate it into an address. If those questions go outside the tunnel, your local network or internet provider can see which sites you look up. A DNS leak is common and often caused by a custom setting or a network change. To test it, run a DNS leak test while connected and compare the resolvers shown against your baseline. They should not include your normal provider. Read what DNS is if the terms are new.

WebRTC. Browsers include a feature, WebRTC, used for video calls and peer-to-peer connections. In some configurations it can reveal your local or real public IP address to a website even when a VPN is on. Open a WebRTC test page while connected. The addresses shown should not be your baseline address. What is a WebRTC leak explains the causes and fixes.

Run both tests in more than one browser, because each browser handles DNS and WebRTC differently. A pass in one does not guarantee a pass in another.

Test the kill switch and reconnection

A kill switch is a feature that blocks internet traffic when the VPN connection drops, so nothing is sent unprotected. What is a VPN kill switch covers how it works. Testing it matters because drops happen: weak Wi-Fi, switching from Wi-Fi to mobile data, a laptop waking from sleep.

A simple test:

1. Connect to the VPN and confirm your IP address has changed.
2. Start a continuous ping to a reliable address, or a long download, so you can see traffic flowing.
3. Interrupt the connection without closing the app, for example by turning Wi-Fi off and on, or moving from Wi-Fi to mobile data.
4. Watch what happens. With a working kill switch, the ping or download stops until the VPN reconnects. Without one, it may carry on over your normal connection, and a fresh IP lookup would show your real address.
5. After the VPN reconnects, run the IP and DNS tests again.

Also test these everyday events and note what the app does: closing and reopening the laptop lid, switching between two Wi-Fi networks, starting the device with the VPN set to connect automatically, and leaving the VPN idle for an hour. A good VPN reconnects quickly and tells you what is happening. If your app has no kill switch, you will see the gap clearly, and you can decide whether that matters for how you use it.

Measure speed, latency and throughput

Speed tests are easy to run and easy to misuse. A VPN almost always adds some overhead, because traffic is encrypted and takes a longer route through the VPN server. The goal is to measure how much, under fair conditions. Why internet speed changes with a VPN explains the causes in more detail.

Three numbers matter:

Measure	What it tells you	Good practice
Latency (ping)	How quickly a small message gets a reply	Lower is better. Matters for calls, gaming and remote desktops
Throughput (download and upload)	How much data per second you can move	Matters for downloads, uploads and high-quality video
Consistency	How much the numbers vary	Run several tests and look at the spread, not only the best result

A fair method:

1. Change one variable at a time. If you compare two connection methods, use the same device, network and time of day.
2. Run each test at least three to five times, and use the median. A single result can be skewed by other devices on your network.
3. Use the same test server for before and after tests when the tool lets you choose.
4. Test at different times. Evening is often the busiest time on home networks.
5. Test close and far. A nearby VPN server usually has lower latency than a distant one, so note which one you picked.
6. Close other bandwidth users. Pause cloud backups, updates and streaming on other devices.

Compare the median of your connected tests with your baseline. A moderate drop is normal. A very large drop, or large swings from test to test, point to a congested server, a weak connection method or a problem with your own Wi-Fi.

Run real-world tests, not only synthetic ones

Speed-test sites measure raw transfer to a test server. What you actually care about is whether your daily tasks work. Try these while connected:

• Video calls. Hold a 10-minute call. Note frozen video, robotic audio or dropped connections.
• Streaming playback at your own location. Play a video at a fixed quality for a few minutes. Note buffering and quality drops. This is about stability, not about reaching other regions; streaming services set their own terms for VPN use, so check them.
• Large downloads. Download a large file and compare the time with and without the VPN.
• Browsing. Open a handful of ordinary sites and note whether pages load slowly or time out.
• Gaming or remote desktop. If you use either, watch for jitter, which is the variation in latency.
• Mobile data. Repeat the main tests on a mobile connection, where results often differ from home Wi-Fi.

Write a quick pass or fail for each. These tests show whether the service is good enough for your actual use, which a single throughput number cannot.

Audit the app: trackers and permissions

A VPN app sits between you and the internet, so it deserves more scrutiny than most apps. A few checks take minutes:

1. Review permissions. On your phone, open the app's permission list. A VPN needs permission to create a VPN connection and to use the network. It should not need your contacts, microphone, camera or precise location. If it asks, ask yourself why.
2. Read the privacy label or policy. App stores show what data an app says it collects. Look for words like advertising identifiers, analytics and "shared with third parties".
3. Look for ads and trackers. If the app shows advertisements inside the interface, assume it includes advertising code. Recent phones can show a privacy report of the domains an app contacts. Use that, or a trusted network monitoring tool, to see whether the app talks to many analytics or advertising domains.
4. Check where the app comes from. Install only from official stores or the provider's own website, and check the developer name.
5. Check updates. A VPN app that has not been updated for a long time is a risk. Look at the release history.
6. Test uninstall. After removing the app, check that the VPN profile and any extra certificates it added are also gone from the system settings.

None of these proves a service is safe, but red flags here are a good reason to move on.

Compare connection methods on your own network

If your app offers more than one connection method (a protocol), do not assume the default is best for you. A fair comparison on your own network:

1. Pick one device, one network and one server.
2. Connect with method A. Record connection time, latency, download and upload, and how it behaves when you switch networks.
3. Disconnect, switch to method B, wait, and repeat the same measurements.
4. Compare results and also compare reconnection after a short network drop.

Results vary a lot between networks. A method that is fast at home may be slower on a hotel network, and the reverse can happen too. Record which one you choose for which place. Your account's setup page lists the methods available to you.

Keep a test log, know the limits, and decide

Write the results down in a small table: date, device, network, test, result, pass or fail. After a week of normal use you will have a realistic picture, and you can repeat the same table after any major update to the app or operating system.

Test	Result	Pass or fail
IPv4 changed while connected
IPv6 not exposed
DNS servers differ from baseline
WebRTC shows no real address
Kill switch blocks traffic on drop
Reconnects after sleep or network change
Latency and throughput acceptable
Real-world tasks work
App permissions reasonable

Know what these tests cannot do:

• A passing result is a snapshot. Networks, apps and operating systems change, so retest from time to time.
• Leak tests show what is visible from your device. They cannot show what a provider keeps on its own systems.
• Testing does not make you anonymous. Cookies, fingerprints and logins still follow you.
• Do not disable security features, such as a firewall, to make a test pass.
• Do not run tests on a work or school device in ways its administrators have not approved.

Summary

To test a VPN, take a baseline of your IP address, DNS servers and speed, connect, and then check for IP, IPv6, DNS and WebRTC leaks. Test the kill switch and reconnection by interrupting the connection on purpose, measure latency and throughput fairly with repeated runs, try real tasks such as calls and downloads, and audit the app's permissions and trackers. Keep a log, and repeat the checks after updates.

If you want a connection to try these tests on, a prepaid XPASS pass gives you a fixed period with no automatic renewal.