"Is my VPN working?" is a question with four different answers, and most guides on the subject test one of them and call it a day. Your public address can be perfectly hidden while your provider still receives the list of every site you visit.
Here are the four checks, in the order that matters, and the honest statement of what none of them can reach.
Check 1: is your public IP actually the VPN's?
The easiest one, which is why it is the one everybody runs.
Note your address before connecting, then connect and look again. If it is unchanged, nothing else in this article matters yet.
This check is necessary and weak: it tests the single thing every VPN gets right. Passing it tells you the tunnel exists, nothing more.
Check 2: DNS, the leak that hides in plain sight
Every site you visit starts with a name to resolve. That request can travel outside the tunnel even when your traffic goes through it, typically to your internet provider's resolver, configured by your router long before the VPN existed.
The result is the worst of both worlds: websites see the VPN's address, and your provider keeps a complete list of the domains you visit. You are paying for privacy and handing over the index.
Run our diagnostic tools with the tunnel up, and check that the resolver reported belongs to the VPN and not to your ISP. On the command line:
# The resolvers your system will actually use
resolvectl status | grep -A2 "DNS Servers" # systemd based Linux
scutil --dns | grep nameserver # macOS
Check 3: WebRTC, the browser going around the tunnel
WebRTC is the browser technology behind video calls in a tab. To connect two people directly, it needs to know their real addresses, and it can obtain them through a mechanism that does not care that you installed a VPN.
The tunnel is up, the browser leaks anyway. It is not a flaw in your VPN, it is a different layer entirely, which is exactly why an IP check does not catch it.
Test it on our WebRTC leak test with the tunnel connected. If your real address appears there, disable WebRTC in your browser or use an extension that blocks it, then retest.
Check 4: the kill switch, which almost nobody tests
A kill switch is a promise that when the tunnel drops, traffic stops instead of silently continuing over your normal connection. It is the feature that protects you at the exact moment you are not watching.
Nearly nobody verifies it, because doing so requires deliberately breaking something. Here is the test:
# Terminal 1: a continuous ping, and watch this window
ping 1.1.1.1
# Terminal 2: drop the tunnel while terminal 1 keeps running
sudo ip link set tun0 down # Linux, name may differ: check with "ip link"
# or simply kill the VPN application
Watch terminal 1 at the moment the tunnel dies. Replies must stop. If they keep arriving, your traffic is leaving outside the tunnel and the kill switch is not doing its job.
Repeat the test after every application update. A kill switch that worked last month is not evidence about today, because updates reset settings more often than anyone admits.
See NordVPN's current offer
Whichever provider you pick, run the four checks above during the refund window rather than after it. A provider that passes them on your own connection is worth more than one that ranks first in a list you did not verify.
What you cannot test, and no article should pretend otherwise
The no-logs claim. It describes what happens on machines you will never touch. No test run from your laptop can reach it, and any page offering you a "no-logs test" is selling you something.
What genuinely counts as evidence:
- An independent audit of the infrastructure, published, with its scope stated. An audit covering only the browser extension says nothing about the servers.
- A court record where data was demanded and none existed. This is the strongest evidence there is, precisely because it was not chosen by the provider.
- The architecture, when servers run without persistent storage so there is no disk on which to keep anything.
Everything else is a marketing sentence, including on providers we recommend. The four checks above are yours to run; this one is not, and saying so is more useful than pretending.
The short version
An IP check tests the easiest thing. DNS is where privacy usually fails, WebRTC bypasses the tunnel from a different layer, and the kill switch is the one you have not tested and the one that will matter. Run the four during the refund window, and retest after every update.
For the legal picture around all of this, see are VPNs legal, and for what an advertised server location really means, see VPN server locations.
Secure your connection with NordVPN
Threat Protection blocks trackers & malware · kill switch · 30-day money-back
