How to check if your VPN is working
- Author
- By Amelia Ame
- Last checked
- Updated September 10, 2026
- Reading time
- 6 min read
A connected VPN can still leak. Five checks that take two minutes and tell you whether yours is doing the job — with what a pass and a fail actually look like.
- Ran all five checks against all ten VPNs on Windows, macOS, iOS and Android
- Killed the tunnel mid-transfer on each to test whether the kill switch actually holds
- Recorded which providers ship their kill switch and DNS protection off by default
A green 'connected' badge tests one of them. The other four are where VPNs actually fail.
- Commonest failure
- DNS on Windows
- Passed all 5
- 10 of 10
- Default-off switches
- 3 of 10
Run on Windows, macOS, iOS and Android; re-tested monthly
The short answer
Load an IP checker with the VPN off and note your address and ISP, then turn the VPN on and reload — both should change. Then run a DNS leak test, a WebRTC test, and kill the tunnel mid-download to check the kill switch. A VPN that shows 'connected' can still fail any of the last three.
A VPN app has one indicator and it tests one thing: that a tunnel exists. It says nothing about whether your DNS is going through that tunnel, whether your browser is quietly handing out your real address, or what happens the moment the connection drops.
Those are the three ways a "connected" VPN fails, and none of them look like a failure.
The five checks
- 1
Note your real IP and ISP — with the VPN off
Load our IP checker before you connect and write down two things: the address and the ISP name.
The ISP matters more than the address. It is the piece that tells you whether your traffic is genuinely leaving through the VPN's network rather than yours.
- 2
Connect, reload, and compare
Turn the VPN on, wait for it to report Connected, and reload the checker.
A pass: a different IP address and a different ISP — the VPN provider's or its hosting company's.
A fail worth knowing: the country changed but your own ISP is still listed. That usually means a browser extension is proxying the page while the rest of the device runs unprotected, or a split-tunnelling rule is sending the browser outside the tunnel.
No change at all: most often a cached page. Hard-refresh or open a private window before concluding anything.
- 3
Run a DNS leak test
This is the one that fails most, and it is invisible from inside the app.
Your traffic can be perfectly tunnelled while your DNS lookups go to your internet provider's resolver — handing them a timestamped list of every domain you visited, which is exactly what you installed a VPN to prevent.
A pass: every resolver listed belongs to the VPN provider, or to a neutral resolver it uses.
A fail: your ISP's name appears — BT, Comcast, Virgin, whoever. Fix it by enabling the app's own DNS leak protection, which every VPN we rate has.
Why Windows especially: a feature called smart multi-homed name resolution asks every network adapter at once and takes the fastest answer. Your ISP's resolver is usually physically closer, so it usually wins.
- 4
Run a WebRTC leak test
WebRTC is the browser feature behind video calls. To work, it needs your real IP — and it will hand it to any page that asks, tunnel or no tunnel.
Your ISP learns nothing new from this one. The websites you visit learn everything you were hiding.
Our WebRTC test runs entirely in your browser and compares what WebRTC exposes against the address our server sees. A mismatch is a leak. Blocked WebRTC counts as a pass.
- 5
Break it on purpose to test the kill switch
Start a large download. While it is running, disconnect the VPN from inside the app.
A pass: the transfer stops dead and does not resume until you reconnect.
A fail: it carries on, which means every check you just passed becomes irrelevant the next time your connection drops on its own — and it will, because laptops sleep, phones change networks and servers restart.
This is the check nobody runs and the one that covers the moments you are not watching.
What each check actually proves
| Check | Proves | Does not prove |
|---|---|---|
| IP changed | Traffic is leaving through the VPN | That DNS is |
| ISP changed | The whole device is tunnelled, not just a browser | Anything about leaks |
| DNS test | Your ISP cannot see which sites you visit | That websites cannot see you |
| WebRTC test | Websites see the VPN's address, not yours | That the tunnel will hold |
| Kill switch | Nothing leaks when the connection drops | Anything while it is up |
Five different failure modes. Passing one tells you nothing about the other four, which is why a routine beats a spot-check.
Which providers arrive ready
| VPN | Kill switch | Stealth mode | RAM-only servers | Last audit |
|---|---|---|---|---|
 NordVPN | Yes | Yes | Yes | Deloitte, 2024 |
 Surfshark | Yes | Yes | Yes | Deloitte, 2025 |
 ExpressVPN | Yes | Yes | Yes | KPMG, 2024 |
 Proton VPN | Yes | Yes | No | Securitum, 2024 |
 PIA | Yes | Yes | Yes | Deloitte, 2024 |
 Windscribe | Yes | Yes | No | Packetlabs, 2024 |
The sixth check, if you need it
Everything above tests whether the VPN is protecting you. There is a separate question: can anyone tell you are using one?
Usually yes. A steady encrypted connection to a known VPN address on a VPN port is easy to identify. In most countries that is unremarkable — VPNs are legal and ordinary.
It matters in two cases: a network that blocks VPNs (school, office, some hotels) and a country that filters them. The answer to both is obfuscation, which disguises the tunnel as ordinary HTTPS. Nine of the ten VPNs we rate offer it; CyberGhost is the one that does not, which is why it will not work in China.
To test it: connect with obfuscation on and see whether the network that was blocking you now lets you through. There is no browser-based test for this — the network is the test.
When a check fails
IP unchanged — hard-refresh first. Then disconnect fully and reconnect. Look for a system-level indicator (the key icon on Android, the VPN badge on iOS, the menu-bar icon on macOS) rather than trusting the app's own screen.
ISP unchanged but country changed — you are using a browser extension rather than the app, or a split-tunnelling rule is excluding your browser. Check both.
DNS leaking — turn on the app's DNS leak protection. If it is already on and still leaking, reinstall the client; on Windows, ipconfig /flushdns in an admin prompt afterwards.
WebRTC leaking — enable the provider's WebRTC blocking if it has one, or disable WebRTC in your browser's settings. Note this can break video calls, which is the trade.
Kill switch not holding — check it is actually enabled. If it is, this is a reason to switch provider; a kill switch that does not hold is the one failure with no workaround.
Re-test after anything changes
Networking configuration is fragile in specific, predictable ways:
- Windows updates have a history of resetting network adapter settings
- A new router can change how DNS is handed out
- Reinstalling the VPN resets its settings to defaults, including any you had turned on
- Switching protocol can change leak behaviour
- A new device starts from scratch
Two minutes each time. It is the cheapest habit on this site, and it is the difference between a VPN that works and one you believe works.
Common questions
How do I know if my VPN is actually working?
The reliable test is comparison. Load an IP checker before connecting and note your address and ISP, then connect and reload — both should change. That confirms the tunnel is carrying your traffic. It does not confirm your DNS is going through it, which is a separate check and the one that fails most often.
My VPN says connected but my IP has not changed. Why?
Usually a cached page — reload with a hard refresh, or open a private window. If it still shows your real address, the app is reporting a connection it does not have: disconnect fully, reconnect, and check for a system-level indicator like the key icon on Android or the VPN badge on iOS rather than trusting the app's own screen.
What is a DNS leak and how do I test for it?
Your traffic goes through the tunnel but your DNS lookups go to your internet provider's resolver instead, handing it a timestamped list of every domain you visited. Run a DNS leak test with the VPN connected — every resolver listed should belong to the VPN. Your own ISP's name appearing there is the failure. It is commonest on Windows.
How do I test a VPN kill switch?
Start a large download, then disconnect the VPN from within its app while the transfer is running. The download should stop immediately and not resume until you reconnect. If it carries on, the kill switch is either off or not working, and every other check you passed becomes irrelevant the next time your connection drops.
Can a VPN show connected but not be protecting me?
Yes, and this is the whole reason for the other four checks. The app's indicator tells you a tunnel exists. It does not tell you whether DNS is going through it, whether WebRTC is revealing your address to websites, or whether traffic will keep flowing when the tunnel drops.
How often should I re-test?
After anything that touches networking: a Windows update, a new router, reinstalling the VPN, changing protocol, or switching providers. Windows updates in particular have a history of resetting network adapter settings. Two minutes is cheap compared to assuming.
Read next
- PrivacyWhat does a VPN hide?It hides your browsing from your ISP and your IP from websites. It does not hide you from anything you log into — the full list, both ways.
- PrivacyCan your internet provider see your history if you use a VPN?It hides the domains you visit, not that you're using a VPN. We ran 40 leak tests to find where the line actually falls — and where it silently moves.
- SetupHow to set up a VPN on Windows 11Use the provider's app — it takes two minutes and gives you the kill switch. The built-in Windows VPN client is for work networks, and here is why it leaks.