What Is an IP Leak? IPv4 and IPv6 Leaks Explained

You connect to your VPN, the app shows a green status, and you assume your real IP address is hidden. Most of the time that is exactly what happens. Occasionally it is not. A small amount of traffic can slip out along a different route, and a website sees the address your internet provider gave you rather than the VPN's address. That slip is called an IP leak.

This article explains what an IP address is, how leaks happen over IPv4 and IPv6, how to test for them, and what a sensible person can do about it. It completes a trio with our articles on DNS leaks and WebRTC leaks, which are the other two common ways identifying information escapes a VPN.

What an IP leak is

An IP address is the number your connection uses to send and receive data on the internet. Every website you visit sees the address your request came from. Our guide to the public IP address covers the basics.

A VPN changes this. Your traffic goes through an encrypted tunnel to the VPN server, and websites see the server's address. An IP leak is any moment when traffic bypasses the tunnel and reaches a destination with your real address. The VPN looks connected, but for that traffic it is not doing its job.

It helps to be precise about what a leak is not. It is not the VPN provider seeing your address, because the provider must see it to connect you. It is not a website knowing who you are from a login, which our article on whether a VPN hides your IP address discusses. An IP leak is specifically about your real address appearing where the tunnel should have replaced it.

IPv4 and IPv6 in plain terms

The internet runs on two versions of the address system at the same time. Understanding both is the key to understanding most leaks.

Feature	IPv4	IPv6
Example look	Four numbers, such as 203.0.113.25	Long groups of letters and numbers separated by colons
Size	32 bits, around four billion addresses	128 bits, an enormous number of addresses
Specification	RFC 791	RFC 8200
Sharing of addresses	Very common: homes and offices often share one public address through address translation	Each device can have its own public address
Private ranges	Private blocks defined in RFC 1918 are used inside home networks	Devices often have globally reachable addresses
Status	Still used everywhere	Growing, and used by many networks and websites

IPv4 was defined in RFC 791 in 1981. Its address space is small by modern standards, which is why home and office networks typically hide many devices behind one shared public IPv4 address, using private ranges described in RFC 1918 internally. IPv6, specified in RFC 8200, was designed to replace it with a far larger address space.

Most networks today run both at once, a setup called dual stack. Your device may have an IPv4 address and an IPv6 address. When a website supports both, many systems prefer IPv6. That detail matters for leaks.

How an IPv4 leak happens

IPv4 leaks are the classic kind. They usually come from one of these causes:

1. The VPN connection drops. The device falls back to the normal route and apps carry on over your ordinary address. A kill switch is designed to stop this, but only if it is on and working.
2. Split tunnelling is in use. Some apps are deliberately excluded from the tunnel, so they show your real address. That is a setting, not a bug, but it is easy to forget.
3. Routing mistakes. A misconfigured profile, a second network adapter, or software that sets its own routes can send some traffic around the tunnel.
4. A connection that is only partly up. During reconnection after sleep or a network change, there may be a short window before the tunnel carries all traffic.
5. A local network exception. Traffic to devices on your own network, such as a printer, correctly stays outside the tunnel. This is not a leak to the internet, but confuses some people.

How an IPv6 leak happens

A VPN IPv6 leak is the one most people have never heard of. It looks like this:

1. Your home or mobile network gives your device both an IPv4 and an IPv6 address.
2. Your VPN creates a tunnel that carries IPv4 traffic only, or it does not route the IPv6 side of the traffic through the tunnel.
3. You visit a website that supports IPv6. Your device, preferring IPv6 when it is available, connects over IPv6 using the normal network.
4. The website sees your real IPv6 address, even though your IPv4 address shows the VPN's address.

Nothing has "broken". The tunnel is doing exactly what it was set up to do, which is to carry only part of your traffic. This is why the difference between IPv4 and IPv6 matters when you test.

An IPv6 address can also be more revealing than an IPv4 one. Because every device may have its own public address and the first part of the address is tied to your network, an IPv6 address can identify your household's connection more directly than a shared IPv4 address does. That does not make it a disaster, but it does make a leak worth fixing.

Three everyday examples

The home user. Dao's internet provider gives her a dual-stack connection. Her VPN carries only IPv4. She checks an IP-check page, sees the VPN's IPv4 address and assumes all is well. A second test page that shows IPv6 would reveal her provider's IPv6 address.

The traveller. Pim connects to hotel Wi-Fi, the VPN connects, and he checks only the IPv4 address. The hotel network has IPv6, and a website that supports it sees his hotel's IPv6 address.

The remote worker. Kai excludes his video call app from the tunnel to reduce delay. The app shows his real IPv4 address to the call service. That is deliberate, but it is still a case where his real address is visible.

Why it matters, and why it should not cause panic

An IP leak is worth fixing because it undoes part of what you wanted from the VPN: a website, or anyone watching that traffic, sees the address your provider gave you. That address can show roughly where you are and which provider you use, and a provider can link it to your account.

At the same time, keep it in proportion:

• A leak shows an address, not your messages. If the connection uses HTTPS, the content is still encrypted between you and the site.
• It is usually partial. Some traffic leaks, not all.
• Often the fix is simple, such as a setting or a different configuration.
• A leak does not by itself mean your VPN provider is untrustworthy. It means the configuration is incomplete.

How to test for an IP leak

You do not need special tools. A short routine is enough. See also our help guide on how to check whether your VPN is working.

1. Disconnect the VPN. Open an IP-check page and write down both addresses it shows, IPv4 and IPv6 if it displays one. Some pages show only one, so use a page that shows both, or run two checks.
2. Connect the VPN. Wait until the app shows connected.
3. Check again. Reload the same page. Your IPv4 address should now be different from the original.
4. Look at the IPv6 line. It should be either absent (the page says IPv6 is not available), or a different address from the one you wrote down. If it still matches your original IPv6 address, you have an IPv6 leak.
5. Test after a disruption. Switch Wi-Fi networks or toggle airplane mode, then check again. This tests how the setup behaves when the connection changes.
6. Test with the apps you use. An IP-check page in a browser does not prove every app behaves the same, especially if you use split tunnelling.

Reading the results

What you see	What it likely means
IPv4 changed, no IPv6 shown	The tunnel is working, and IPv6 is either not in use or blocked
IPv4 changed, IPv6 matches the original	IPv6 is leaking outside the tunnel
IPv4 matches the original	The tunnel is not carrying that traffic at all
Both changed	No sign of a leak in this test
IPv4 changes, then reverts after a few minutes	The connection is dropping and falling back

A single clean test is encouraging, not proof. Repeat it on the networks you actually use.

Windows, IPv6 and what to do about it

Windows is a common place where questions about IPv6 come up, because the system supports IPv6 by default. The built-in VPN features are described on Microsoft's support page on connecting to a VPN in Windows, but that page is about setting up connections, not about leak testing.

If your test shows an IPv6 leak on Windows, here is a sensible order of response:

1. Check the app's settings. Look for options about IPv6 handling or leak protection, and enable them.
2. Update the app and the operating system. Network behaviour changes with updates.
3. Consider the system-level fix with care. Many guides suggest turning off IPv6 on the network adapter. Microsoft does not recommend disabling IPv6 entirely, because some system components may depend on it, so treat this as a temporary workaround and note what you changed so you can undo it.
4. Test again. Repeat the test after every change.

On macOS, network settings usually let you adjust IPv6 handling per network service. On Android and iOS, the VPN app and the operating system handle most of this for you, so the main step is to test. Settings and wording differ between versions.

Reducing the risk: a short checklist

• Test with both address types. Check IPv4 and IPv6, not only the first number you see.
• Keep the kill switch on if your setup has one, and test it.
• Review split tunnelling. Know which apps are excluded.
• Prefer connection methods and apps that document their IPv6 handling.
• Keep apps and systems updated.
• Retest when something changes, such as a new router, a new network or a system update.
• Combine checks. An IP leak test is one of three. Also check DNS and WebRTC behaviour.

Limits and what to watch for

• A test page can only tell you what it sees at that moment. Leaks that happen only during reconnection are easy to miss.
• Different test sites report differently, and some show only IPv4.
• Fixing an IP leak does not make you anonymous. Accounts, cookies and fingerprints still identify you. Our article on whether a VPN can make you anonymous covers this.
• Disabling features such as IPv6 is a trade-off, not a free fix.
• This article is general education. Your results depend on your network, device and VPN setup.

Summary

An IP leak is any moment when your real IP address reaches a website while your VPN looks connected. It can happen over IPv4, usually because the connection drops, an app is excluded or a route bypasses the tunnel. It can also happen over IPv6, when the tunnel carries only IPv4 while your device has working IPv6. The remedy is the same: test both address types, understand your settings, keep the kill switch on and retest after changes.

If you want to try these checks on a connection of your own, you can set up a short prepaid pass on the XPASS pricing page and run the tests on your own devices.