Can Someone Track My Real IP Address When I Use a VPN?

Short answer: a properly working VPN hides your real IP address from every website and service you connect to. Longer answer: "properly working" is doing a lot of the work in that sentence, and there are several specific, well-understood ways your real IP can still leak even with a VPN turned on. Here's exactly how that happens, and how to check whether it's happening to you.

How a VPN Hides Your IP in the First Place

When you connect to a VPN, your device builds an encrypted tunnel to a VPN server. From that point on, every website you visit sees the VPN server's IP address, not yours — your traffic appears to originate from the server's location, not your actual device. That's the entire mechanism, and when it works as intended, your real IP simply never reaches the sites and services you use.

Way 1: DNS Leaks

Every time you visit a domain name, your device needs to resolve it to an IP address via a DNS query. If those queries bypass the VPN tunnel and go straight to your regular network's DNS resolver, your ISP (and potentially the sites you visit through DNS-based tracking) can see which domains you're requesting — tied to your real network connection. See our full DNS leak protection guide for how this happens and how it's prevented.

Way 2: WebRTC Leaks

WebRTC is a browser feature used for video calls and real-time communication. It can request IP address candidates directly from your network interface, sometimes bypassing the VPN tunnel entirely, which lets a website read your real IP through browser JavaScript even while your other traffic is properly tunneled. This is a browser-level leak, not a flaw in the VPN protocol itself.

Way 3: A Dropped Connection Without a Kill Switch

VPN connections occasionally drop — switching from WiFi to mobile data, a weak signal, a server hiccup. Without a kill switch, your device falls back to your normal, unencrypted connection the moment the tunnel drops, exposing your real IP for however long it takes you to notice and reconnect. A kill switch blocks all traffic during that gap instead of letting it fall through. See our kill switch explainer for how this works.

Way 4: The VPN Provider Itself

The VPN server obviously does see your real IP — it has to, in order to route your traffic. The question is what the provider does with that information afterward. A VPN with a genuine no-logs policy doesn't record which real IP connected to which server at what time; a VPN that logs connection metadata retains exactly the link between your identity and your activity that the VPN was supposed to remove. This is why the provider's logging policy matters as much as the encryption itself — see our guide on what a no-logs policy really means.

Way 5: Browser Fingerprinting (Different From IP Tracking)

Worth separating out: a website can still identify and track you across visits without your IP address at all, using your browser's fingerprint — screen resolution, installed fonts, timezone, and dozens of other signals combined into a near-unique identifier. A VPN doesn't address this; that's a separate problem covered in our guide to avoiding online tracking.

How to Check If Your Real IP Is Exposed

1. Connect to your VPN
2. Visit an IP-checking site and confirm it shows your VPN server's location, not your own
3. Run a dedicated DNS leak test to confirm DNS queries are also routed through the tunnel
4. Test WebRTC specifically, since a standard IP checker often won't catch this leak type

We walk through this process in detail, including specific tools, in our VPN leak test guide.

How CarrotVPN Addresses This

Related Articles