How to Tell If Your VPN Is Actually Working: Four Checks That Prove It
Last updated: November 5, 2026 · Steps checked against NordVPN support pages and Mozilla's WebRTC documentation (sources at the bottom)
We may earn a commission if you buy through links here — it never changes our picks.
Your VPN app says Connected. That is a claim, not a proof. A VPN, short for virtual private network, is supposed to route your internet traffic through an encrypted tunnel to a server somewhere else, so the network you are on sees the tunnel and nothing inside it. Most of the time it works. Sometimes it quietly does not: a setting resets after an update, one browser leaks around the tunnel, or the safety net you turned on last month is off again. This guide runs the four checks that settle the question with evidence instead of trust.
If your VPN is not set up yet, start with our step-by-step VPN setup guide and come back here when it connects. If it is set up, connect now and work through the checks in order. The first run takes about ten minutes. Once you know the routine, the whole thing takes two.
The four terms these checks use
- IP address. The number your connection shows to every website you visit. Websites use it to guess roughly where you are. When a VPN works, sites see the VPN server's address, not your home one.
- DNS. The internet's phone book. Before your device visits a site, it looks the site's name up in DNS to find the address. If those lookups travel outside the tunnel, the network can see which sites you are visiting even though it cannot see the pages themselves. That is a DNS leak.
- WebRTC. A feature built into web browsers so sites can run voice and video calls with nothing extra to install. To set calls up, it collects network addresses, and a test page can sometimes read your real address through it even while a VPN is running. That is a WebRTC leak.
- Kill switch. A setting that cuts your internet entirely if the VPN connection drops, so nothing slips out unprotected during the gap. Different apps give it different names, which the kill switch check covers.
Before you test: make it a fair test
Every check below compares two readings: your connection with the VPN off, and your connection with it on. If you skip the first reading, you have nothing to compare against, and a leak can hide in plain sight.
Take the baseline reading with the VPN off
Disconnect the VPN. In your browser, search "what is my IP address" and write down the address and the city shown. That address is your home connection's public face. Everything in this guide is about making sure it stays hidden while the VPN is on.
Connect to a server in a city you choose
Open your VPN app and pick a specific server city yourself, ideally one well away from where you live, instead of using the automatic fastest choice. An automatic choice often lands in your own metro area, which makes the results ambiguous. A distant city makes pass and fail obvious.
Change nothing else mid-test
Use the same browser and the same test pages for every check, and stay on the same Wi-Fi network throughout. Switching browsers or networks between readings introduces differences that have nothing to do with the VPN.
Baseline address and city written down · VPN connected to a city you picked · same browser for every test. Now run the checks.
Check 1: Your IP address and location
This is the headline test. If your address and location do not change when the VPN connects, nothing else in this guide matters, because the tunnel is not carrying your traffic at all.
Search "what is my IP address" again
With the VPN connected to your chosen city, run the same search in the same browser. Most search engines and many provider sites will show your current public address and the location attached to it at the top of the results.
Compare against the baseline
Pass: the address is completely different from your baseline, and the city shown matches, or sits near, the server city you picked. Fail: the address or the city is the same as your baseline. That means websites can still see your real connection.
Read the city loosely, the address strictly
Location databases are approximate. They sometimes place a server in a neighboring city, and they never show a street address, yours or the server's. Treat the city as a rough confirmation. Treat the address itself as exact: if it matches your baseline digit for digit, the check has failed no matter what the city says.
If this check fails, do not bother with the rest yet. Disconnect, restart the device, reconnect to a different server, and run it again. A failure here is a connection problem, and the fixes at the bottom of this guide are the right next step.
Check 2: The DNS leak test
Your pages can be safely inside the tunnel while your DNS lookups walk around outside it. That is a DNS leak, and it tells the network operator, and whoever runs the DNS service being used, which sites you are visiting. The fix-it-yourself version of this check takes one minute.
Open your provider's DNS leak test
With the VPN still connected, search for your provider's own test. NordVPN's is found by searching "NordVPN DNS leak test". Most large providers publish an equivalent page. Open it and let it finish; it reports which DNS servers answered your lookups and who operates them.
Read the verdict
Pass: NordVPN's test shows "Connected to NordVPN." On other providers' tests, the pass looks like DNS servers that belong to the VPN company, in or near your chosen server city. Fail: the results name your ordinary home internet provider, or show servers in your home area while your VPN server is somewhere else. Your lookups are escaping.
If it fails, restart and retest before changing anything
NordVPN's own advice for a test that does not show the connected message is plain: restart the device, reconnect, and run the test again. Stale network state after an update or a sleep cycle is a common cause, and a restart clears it. Only move on to settings if the failure repeats on a fresh connection.
One setting worth knowing about if the failure persists: modern browsers offer their own secure DNS feature, called Secure DNS in Chrome and DNS over HTTPS in Firefox. NordVPN's troubleshooting pages list it as a possible source of interference with the VPN's handling of lookups. If your provider's support pages suggest it for your situation, turn the browser feature off, reconnect, and retest. Turn it back on later if the leak turns out to have another cause.
Check 3: The WebRTC check
WebRTC lives in your browser, and browsers are where most of your VPN use happens, so this leak matters even though it sounds obscure. The check shows every address your browser is willing to reveal to a web page. You are looking for one address in particular: your baseline.
Open a WebRTC leak test page
Search "WebRTC leak test" and open one of the test pages. It will list the addresses WebRTC can see, usually within a few seconds, with no sign-up and nothing to install.
Compare every address against your baseline
Pass: the only public address shown is your VPN server's address, the same one from Check 1. You may also see a private address, a string of numbers that starts with 192.168 or 10. That is your address inside your own home network; it does not identify you on the internet and it is not a leak. Fail: your baseline public address appears anywhere in the results. Your browser is handing your real address to sites around the VPN.
Fix it, in this order
First, run the same test in a different browser. Browsers handle WebRTC differently, and one may be clean where another leaks. Second, if your VPN provider offers a browser extension, check its settings: NordVPN's extension, for example, includes WebRTC leak protection of its own. Third, Firefox users have a manual off switch: type about:config in the address bar, search for media.peerconnection.enabled, and set it to false. Treat that one as an advanced step. WebRTC is what browser-based calls and meetings run on, so turning it off can break them, and you would set it back to true to restore them.
Run this check in the browser you actually use day to day, on each device you browse on. Passing in one browser tells you nothing about the others.
Check 4: Test the kill switch
The kill switch is the setting that decides what happens in the worst moment: the tunnel drops while you are mid-login on café Wi-Fi. You turned it on during setup. This check proves it does its job, by creating a small, safe version of that moment yourself.
Names vary by app and platform, and our setup guide covers the per-device names in its tracks. In short: on Windows the strict version is the Internet Kill Switch, which cuts your connection when you are disconnected from the VPN servers. On iPhone and the Mac App Store version, the same protection is called VPN bypass prevention, and it forces your traffic to stay inside the tunnel. The disconnect test below applies directly to the kill switch versions. On the bypass-prevention versions, treat Checks 1 to 3 as your proof and simply confirm the setting is still on.
Turn the kill switch on, then connect
Open your app's settings and confirm the kill switch is enabled before you connect. Testing with it off proves nothing, and settings can revert after app updates, which is the whole reason this check exists.
Load an IP address page
With the VPN connected, open the same "what is my IP address" page from Check 1 and leave it open, showing the VPN server's address.
Disconnect the VPN in the app
Tap or click Disconnect in the VPN app. Do not close the app, and do not touch your Wi-Fi. You are simulating the tunnel dropping while everything else keeps running.
Try to reload the page
Pass: the page fails to load, and so does any other site you try. Your browser reports there is no connection. Uncomfortable, and exactly right: with the tunnel down, the device refuses to use the open network at all. Fail: the page reloads happily and now shows your baseline home address. For a moment, your traffic ran unprotected, and it would do the same during a real drop.
Reconnect and confirm recovery
Reconnect the VPN and reload once more. Pages should load again, showing the VPN address. A kill switch that blocks on drop but never recovers is its own problem, and reconnecting cleanly is part of the pass.
One shortcut that is not a test: airplane mode. It cuts every radio on the device, so of course nothing loads. It proves your Wi-Fi switch works, not your kill switch. The disconnect has to happen in the VPN app while the network stays up.
When a check fails
Work down this list in order. It follows the same sequence the providers' own support pages use, and the early items solve most failures.
- Restart the device and reconnect. This is NordVPN's stated first move for a leak test that will not show the connected message, and it clears the stale network states that updates and sleep leave behind.
- Change the server. Disconnect, pick a different city yourself, reconnect, and rerun the failed check. One misbehaving server should not condemn the whole app.
- Check split tunneling. Split tunneling is a feature that lets chosen apps or sites bypass the VPN on purpose. If your browser is on the bypass list, it will fail every check in this guide by design. Remove it from the list, or test in a browser that is not excluded.
- Update the app. Leak and kill switch behavior is exactly the kind of thing app updates fix. Check your app store or the app's own update prompt, install, and retest.
- Look for a second VPN or security app. Two tools fighting over the same connection can each break the other's tunnel. If you run another VPN, or a security suite with its own VPN feature, turn that one off and retest.
- Retest after every single change. Change one thing, run the failed check again, then decide. Changing three settings at once leaves you fixed, maybe, and none the wiser about which one mattered.
- Tell support which check failed, and the exact result. "The DNS test names my home provider while connected to your Chicago server" gets a useful answer. "It doesn't work" does not.
- Baseline written down: my home IP address and city, VPN off.
- Check 1 passed: address and city now match the VPN server I picked.
- Check 2 passed: the DNS test shows my provider's connected message, and no sign of my home internet provider.
- Check 3 passed: the WebRTC test shows only the VPN address, in the browser I actually use.
- Check 4 passed: disconnecting the VPN in the app leaves the device with no connection until I reconnect.
- Any failure fixed with one change at a time, and the failed check rerun after each change.
Start with the pick, then prove it works
Choose a paid, reputable provider with a published no-logs policy, apps for every device you own, a kill switch, and its own leak test page, so you can run every check in this guide. Our beginner's VPN buying guide compares the options, and the pick it lands on is the one used throughout this site's walkthroughs.
Where these steps come from
Every procedure in this guide was checked against the official sources below in November 2026. Test pages and app screens change over time; if a name on your screen differs slightly, the setting or result is usually in the same place under a near-identical name.