A VPN does one job, and does it well. It wraps your traffic in an encrypted tunnel to its own server. Your Wi-Fi and your internet provider see only a connection to that server, and websites see the server's IP address instead of yours.
That's the whole job. What a VPN doesn't hide is everything your device says about itself on the way in, plus anything that slips around the tunnel. You can be tracked with a VPN on, and a site can often work out roughly where you really are.
A VPN changes where your traffic comes from. It doesn't change what your device says about itself.
What a VPN doesn't hide, at a glance
| What a website sees | VPN off | VPN on |
|---|---|---|
| IP address | Your provider's | The VPN server's |
| Location from the IP | Your city or region | The server's country |
| DNS resolver | Your provider's | The VPN's, unless DNS leaks |
| Address found by WebRTC | Yours | The VPN's, unless it leaks |
| Time zone and languages | Yours | Still yours |
| Browser fingerprint | Yours | Still yours |
| Cookies and logged-in accounts | Yours | Still yours |
The first two rows are what you pay for. The rest is where people get caught.
1. Your DNS lookups
Before your browser opens a site, it asks for the site's numeric address. That lookup is DNS, the internet's phone book, and the server that answers is a resolver. A VPN should route these questions to its own resolver, inside the tunnel. When they go to your provider's resolver instead, that's a DNS leak: your provider sees the name of every site you open, and any site that checks sees your lookups and your connection coming from two different networks.
Sites spot it with a neat trick: the page makes your browser look up a random, never-used name under a domain the site controls. No resolver has it cached, so the question travels all the way to the site's own name server, which records who asked. Your home provider's resolver next to a VPN's IP means the leak is real.
The usual causes:
- the VPN app doesn't set its own DNS server;
- Windows, when a lookup times out, can resend it on every network interface, including the one outside the tunnel;
- your router hands out IPv6 DNS servers, and the VPN only tunnels IPv4.
Most VPN apps have a DNS leak protection setting. Turn it on.
2. Your real IP, through WebRTC and IPv6
WebRTC is the part of the browser behind video calls and direct file transfers. To connect two browsers directly, it asks a STUN server one question: what address do you see me coming from? The answer is your public IP, and a page can trigger the question without any permission prompt.
With a full-tunnel VPN, the STUN server sees the VPN's address, and nothing new leaks. Your real address gets out in three setups:
- A browser "VPN" extension. In Chrome and Firefox it works as a proxy, and unless the extension blocks it, WebRTC sends its STUN request over UDP, straight past the proxy.
- A split tunnel that lets the browser, or all UDP traffic, bypass the VPN.
- A VPN that only carries IPv4. If your provider also gives you IPv6, that traffic still goes out through your router, so any site you reach over IPv6 sees your real address, and WebRTC can list it next to the VPN's.
Your local address, the 192.168.x.x kind, is mostly safe now: Chrome has replaced it with a random .local name since version 76, unless the site already has camera or microphone access.
3. Your clock and your languages
Any page can read your device's time zone with one line of JavaScript, no permission needed. It comes back as a full zone name, like Europe/Warsaw or America/Chicago, which usually points to one country. The server looks up the time zone of your IP in a geolocation database and compares the two.
A VPN can't touch this. The time zone is a setting on your device, and no VPN protocol carries or rewrites it. Your languages come along unchanged too: the browser lists them in the Accept-Language header, a line of metadata attached to every request.
A laptop set to Europe/Warsaw, with Polish as its first language, behind an IP in a New York data center tells a site two things: the user is probably in Poland, and something sits in between. That's a timezone mismatch. Travellers and company VPNs produce it every day, so on its own it rarely gets anyone blocked. Next to other warning signs, it can mean a CAPTCHA or an extra login check.
The fix is boring: set your device's time zone to match the VPN server, or pick a server in your own time zone. Extensions that fake the zone tend to miss one of the several places a page can read it from, and a browser that reports two zones at once looks worse than an honest mismatch.
This is also why a VPN often isn't hiding your location on maps and delivery sites. A site you've allowed to use your location gets it from the device itself, through GPS or the Wi-Fi networks around you, and a VPN changes neither.
4. Your browser fingerprint and your accounts
Your browser describes itself to every site: screen size, installed fonts, graphics card, CPU cores, and the tiny differences in how your hardware draws an image on an invisible canvas. Together these values form a browser fingerprint, an ID that needs no cookies. Every value is measured on your device, so it stays the same when your IP changes.
Stored data comes along too. Cookies set yesterday on your home connection are still in the browser today, and the moment you log in, the site knows exactly who you are, whatever country your IP is in.
Does a VPN hide your identity, then, or make you anonymous? Not by itself. It hides your address from websites and your browsing from your provider. Your identity lives in the browser and in your accounts, and those don't change inside a tunnel.
The same four things, in a YouTube Short:
How websites detect a VPN anyway
A VPN that leaks nothing is still usually easy to spot, because sites add up clues:
- The address. VPN servers usually run in data centers. Every IP belongs to a network with an ASN, the number that identifies who owns it, and IP databases label hosting networks and known VPN ranges.
- The first packet. A VPN forwards your device's own packets, so your operating system still shows through. That packet also states the maximum segment size (MSS), the largest chunk of data your device accepts at once. Tunnel headers eat into it, so the MSS comes out smaller than on a plain home line, in a range typical of tunnels.
- Proxies leave the opposite mark. A proxy opens its own connection to the site, so the site reads the proxy server's operating system instead of yours. A browser that says Windows over a packet that looks like Linux is the classic proxy pattern.
- Any of the four leaks above.
Detection tells a site that you use a VPN, not who you are. For a bank or a streaming service, that alone can be reason enough for an extra check or a block.
How to check what your VPN leaves exposed
The Privacy & Trust Index on packet.guru is a browser fingerprint test and a leak test in one. It shows what a website sees about your connection and your browser, card by card.
- Turn the VPN off, open packet.guru/whoami and let the scan finish.
- Turn the VPN on, reload the page and wait for the new scan.
- Compare the cards:
- IP Reputation should switch to VPN / PROXY or DATACENTER, and Network Details should show no second address from your home provider.
- DNS Privacy should not say DNS LEAK.
- WebRTC Status should read SAFE or PUBLIC IP MATCH, not LEAK DETECTED.
- Regional Integrity shows TIMEZONE MISMATCH if your clock still points home.
- Read the two scores. Privacy is how hidden you are, Trust is how genuine you look to anti-fraud systems. A VPN can raise the first and lower the second.
The canvas, audio and speech-voice fingerprints usually come out the same in both runs. That's the part the VPN never touched.
For the full set of checks, including a kill switch test for the moment your VPN drops, see the VPN test guide.
Top comments (0)