Leak check and protection

A proxy that is bypassed even once has done its job badly. These are the rules a profile’s traffic follows, and the check that shows you they hold.

No fallback to your own network

A profile with a proxy or a VPN never goes around it. This holds at every moment where another browser would quietly “just connect”:

Moment	What happens
The profile is opened and the connection does not answer	The profile does not open. Its status is Failed and the window says The profile could not start.
Your proxy dies during a session	Pages stop loading with the browser’s proxy error. Nothing is sent directly.
A built-in proxy dies during a session	It is replaced by another built-in proxy and the tab reloads.
A VPN tunnel drops	Traffic of the profiles on it stops, UDP included.

Before a profile opens, its connection is checked unless a recent check already found it working; a VPN is checked every time.

DNS and WebRTC

With a connection assigned, the things that most often leak are closed by the app itself — there is nothing to switch on:

DNS. Site names are resolved through the proxy or by the VPN’s DNS servers, not by your system. The browser’s secure-DNS feature is off for the same reason: it would ask a resolver of its own.
WebRTC. Calls and peer connections may not send UDP past the proxy, so a site cannot learn your real address through them.
QUIC. Off on a proxy route until the app has confirmed that UDP goes through the route — see below.

UDP and HTTP/3

Most proxies carry only TCP. UDP — which HTTP/3 and many calls use — is therefore blocked on a proxy route until the app has measured that the route really carries it:

HTTP, HTTPS and SOCKS4 proxies never carry UDP.
A SOCKS5 proxy may. The route is measured when the profile opens, and UDP is opened only if it goes through the proxy.
A VPN carries UDP inside the tunnel.

Profile Settings › Connection shows the result in two rows:

UDP route: Whether UDP goes through the proxy, is blocked, or has not been measured yet — open the profile to measure it.
HTTP/3: Available on this route, Blocked on this route or Not verified.

Tip. If a proxy claims UDP support but calls do not work, turn on Disable UDP in the connection’s sheet: everything then goes over TCP.

Block direct connections

A profile without a connection uses your own network — that is what Direct Connection means. If no profile of yours should ever do that, turn on Block direct connections in Settings › Connections.

With it on, a profile that has no proxy or VPN is not let onto your own network: nothing is loaded directly, and the profile is marked with a warning that a proxy is required. It is off by default.

The leak check

Select a profile and press Check for Leaks in Profile Settings. The profile does not have to be open: the app offers to load it and run the check without showing a browser window — Load and check.

The check looks at the profile from outside, through its own connection, and reports seven things:

Row	What is compared
WebRTC public IP	The public address WebRTC reveals, against the address of the connection.
WebRTC local IP	Whether addresses of your local network are exposed.
SDP addresses	The addresses written into a WebRTC session description.
DNS resolvers	Which servers resolved the profile’s names.
IPv6	Whether an IPv6 address of yours shows beside the proxy.
Timezone	The profile’s time zone, against the location of the connection.
UDP / STUN	Where UDP sent by the profile comes out.

No leaks detected: All seven passed. A row that could not be checked does not count as passed — so this result needs a route that carries UDP and has an IPv6 address to compare.
Leaks detected: The summary says how many checks failed; each failed row gives the reason and the address that was seen.
Some checks could not be verified: Nothing failed, but not everything could be measured. This is the usual result on a proxy with an IPv4 address only: the IPv6 row has nothing to measure.
UDP is blocked: UDP does not leave the profile at all. That is a safe state, not a leak.
Connection changed — run the check again: The connection was changed while the check ran.

Note. On a direct connection there is nothing to hide behind: the check says that a direct connection exposes your real network address.

The Health column and the top of Profile Settings collect what the app knows is wrong with a profile’s route: the last check failed, the location could not be verified, the fingerprint’s country differs from the proxy’s, the address belongs to a datacenter, a large site challenged it. A failed connection stops the profile, and so does a connection whose country could not be determined; the rest tell you what a site may notice.

Checked against the released app: October 2026. If the app does something else than this page says, the page is wrong — write to [email protected]. What changed in each version is in the changelog.