How to Check That Your VPN Is Actually Working
You've tapped connect, the indicator is glowing green — but how do you know that's a real encrypted tunnel and not just a visual state? Four simple checks, a couple of minutes, no special tools required.
1. The app's own status
The fastest, most obvious sign is a "Connected" status on the app's main screen, along with the name of the selected server and a session-length timer. If the status doesn't switch to "Connected" within a minute, that's already worth investigating — see our article on why VPN won't connect.
2. Checking your IP address
A more reliable check is opening any IP-lookup service in your browser (a search for "my ip" works fine) while the tunnel is on. The country and address it shows should match the server you selected in the app, not your real location. If the address matches your usual one, the tunnel isn't active, even if the app's interface looks connected.
3. Checking your speed
Run a speed test with the VPN on and with it off, then compare. A modest speed drop through the VPN is normal — traffic takes an extra route through the server and passes through encryption. If the speed drops by several times or the connection is unstable, try a different server from the app's list — load varies between nodes.
4. Checking for DNS and WebRTC leaks
Even with an active tunnel, some traffic can occasionally slip past it: DNS requests (which sites you're opening) may go straight to your ISP, and the browser technology WebRTC can expose your real address directly from the browser. With the VPN on, open any public checking tool (search "dns leak test" or "webrtc leak test"): the DNS results should show the VPN provider's servers, not your ISP's, and the WebRTC block shouldn't reveal your home IP. For a step-by-step walkthrough with specific tools, see our article on DNS and IP leaks: what they are and how to check.
What a correct result looks like
Instead of guessing, compare three data points. First check everything without the VPN and note the values, then turn on the tunnel and compare:
- IP and country. Without the VPN — your city and ISP; with the VPN — the data center address of the country of the selected server (say, the Netherlands or Sweden). The address must change.
- DNS servers. Without the VPN — your ISP's resolvers; with the VPN — the service's resolvers (typically 1.1.1.1 and 1.0.0.1). If your ISP still shows up after connecting, that's a DNS leak.
- WebRTC. With correct configuration, your real IP shouldn't be visible here. If it "leaks through," the browser is exposing your address outside the tunnel.
If even one of these three points doesn't change after connecting — the same IP or the same ISP DNS — some of your traffic is going around the tunnel, and that's worth fixing rather than ignoring. What to do about discrepancies is covered in our article on why VPN won't connect.