A leak is traffic that goes around your VPN: name lookups answered by your network's DNS, IPv6 traffic the tunnel doesn't carry, a browser revealing your address through WebRTC, or a few seconds without the tunnel while it reconnects. Check your IP and WebRTC in the browser, run the leak test in the app and turn on Android's Always-on VPN. PryVPN keeps DNS inside the tunnel, routes or blocks IPv6 and covers every app, WebRTC included.
The VPN icon is in the status bar, the app says "Connected", and you assume everything is private. Most of the time it is. But "connected" describes the tunnel, not every packet your phone sends. A leak is anything that slips around the tunnel and reaches the network, or a website, directly.
Leaks became a bigger topic in 2026 for a simple reason: phones now juggle more kinds of connection than ever. IPv6 on mobile data, Wi-Fi calling, browsers that make direct calls, Private DNS, and apps that wake up while the phone switches networks. Each one is a door, and a good VPN keeps every door inside the tunnel.
What counts as a leak
There are four common kinds, and each reveals something different:
| Leak | What it reveals | Who sees it |
|---|---|---|
| DNS | The names of the sites and apps you use | Your Wi-Fi, operator or their DNS provider |
| IPv6 | Your real IPv6 address and where you connect | Websites, and the network you're on |
| WebRTC | Your real IP address, from inside the browser | Any website that asks |
| Reconnection gaps | Everything, for a few seconds | The network you're on |
The good news: all four are easy to check, and all four are solved by how the VPN is built.
Leak 1: DNS
Before any app connects, the phone asks a DNS server for the address of the site. If those questions go to the Wi-Fi's or the operator's DNS instead of through the tunnel, the network gets a tidy list of every site you open, even though the pages themselves are encrypted.
How PryVPN handles it: while you're connected, every lookup travels inside the tunnel to the resolver on your PryVPN server. It checks DNSSEC, keeps no query logs and applies the tracker and malware filters you choose in the Protection tab. If Android's Private DNS is set to another provider, your lookups still travel encrypted inside the tunnel but go to that provider; the leak test in the app tells you when that's the case. Our article on Private DNS and VPNs explains when to combine them.
Leak 2: IPv6
Most phone networks now hand out IPv6 addresses, and many mobile operators give phones only IPv6. A VPN that tunnels IPv4 alone leaves IPv6 traffic free to go straight out, with your real address, to any site that supports it. That's often the biggest leak on mobile data, and the one people don't expect.
How PryVPN handles it: PryVPN connects over IPv4 or IPv6, whichever your network has, and Stealth works over IPv6 too. With IPv6 leak protection on, in the Protection tab, IPv6 traffic goes through the tunnel, or is blocked when the server has no IPv6, so it never goes around it. The IPv6 help article has the details.
Leak 3: WebRTC
WebRTC lets browsers make video calls and share files directly. To set that up, any page can ask the browser for your network addresses. Browser-only VPN extensions and proxies change the address of the browser's normal traffic but often not this one, so a page can still learn your real IP.
How PryVPN handles it: PryVPN is a VPN for the whole device. On Android, all of an app's traffic goes through the tunnel, WebRTC included, so the address a page can discover is the VPN server's. You can see it for yourself with our What is my IP and WebRTC leak test.
Leak 4: the gaps
The quietest leak happens when the tunnel isn't there: while the phone starts up, while it hops from Wi-Fi to mobile data, or while the VPN reconnects after a server stops answering. Apps don't wait; they send whatever they have over whatever connection exists.
How PryVPN handles it:
- With Android's Always-on VPN and Block connections without VPN turned on, Android starts PryVPN with the phone and blocks internet access for apps whenever the tunnel isn't up. PryVPN takes you straight to that screen from Settings › Kill Switch; the Kill Switch help article walks you through it.
- Inside PryVPN, traffic stays blocked while it reconnects or switches servers.
- Every connection comes with a backup server, in another city when possible. If your server stops responding, PryVPN moves you to it in less than 10 seconds, with the VPN active the whole time.
The two-minute leak check
- Without the VPN, open What is my IP in your phone's browser and note the address. That's what every site normally sees.
- Connect PryVPN and reload the page. The address should now be a PryVPN server's, and the WebRTC test below it should find nothing else.
- Open the app's leak test (Protection tab › Leak test › Run test). It checks your public IP, which DNS server Android is using, whether IPv6 goes through the tunnel and whether Android routes traffic through the VPN.
- See it from the network's side with what your network sees: it shows what a café or hotel Wi-Fi could log about your visit, without a VPN and with one.
- Optional: test the speed with our speed test, connected and disconnected, so you know what your connection gives you through the tunnel.
If step 2 still shows your own address, make sure no app is excluded with split tunneling and that the browser isn't using a proxy extension, then run the check again.
A note on apps you choose to exclude
Split tunneling lets you keep some apps outside the VPN, which is handy for a banking app that refuses VPN connections or for casting to a TV. That's not a leak but a choice: those apps use your normal connection on purpose. Keep the list short and you keep everything else in the tunnel.
What a VPN covers, and what you keep in your hands
A VPN closes the doors at the network level: your IP, your lookups and the sites you reach stay inside the tunnel. Sites you sign into still know it's you, because you told them, and cookies belong to your browser. Pair PryVPN with your browser's private mode when you want both layers; our page on private browsing with a VPN explains how they fit together.
Frequently asked questions
Is a DNS leak a problem if every site uses HTTPS?
Yes. HTTPS hides what you do on a site, not which site it is. A leaked lookup tells the network the name of every site and app you open.
Should I turn IPv6 off on my phone?
There's no need. With IPv6 leak protection on, PryVPN carries IPv6 through the tunnel or blocks it, so you keep IPv6-only networks working without any leak.
Does a website DNS leak test work on Android?
A real DNS leak test needs a DNS server of its own to see which resolver asks for a one-time name. The leak test inside the PryVPN app checks directly which DNS server Android is using, which is the answer that test is trying to find.
Do I need to repeat the check?
Run it once after installing, and again if you change networks often, use a new browser or turn on Private DNS. The app's leak test takes a few seconds.
PryVPN is a free WireGuard VPN for Android with no activity logs. Join the beta and we'll email you when there's room; it installs from Google Play. Wondering why a site won't open on your network in the first place? Read how DNS, SNI and IP blocking work.
Sources
Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.
