Skip to content
ScanMyPrivacy
Menu

Privacy and leak tests

Full Privacy ScanDNS Leak TestWebRTC Leak TestBrowser Fingerprint TestAm I Using a VPN?HTTP Headers ViewerUser Agent CheckerOpen Port Checker

Online safety assistant

Website Safety CheckerSuspicious Link CheckerScam and Phishing Message CheckerBrowser Security GuideMobile App Safety CheckPersonal Security Checkup

IP and network lookups

IP LookupMy IP LocationWhat Is My Public IP?What Is My IPv6 Address?Reverse DNS LookupDNS Lookup
Online safety Guides API About

VPNs & DNS

How to Test Your VPN Kill Switch

Updated · 2 min read

Written by the ScanMyPrivacy team. How we write and check guides · Report a correction

Try it yourself:Am I Using a VPN?Full Privacy Scan

A VPN kill switch blocks your internet traffic if the VPN connection drops, so your real address is never exposed when the tunnel fails. Almost every VPN app advertises one. Very few people ever check that it works. This test takes about five minutes and uses nothing but a terminal and a free IP lookup.

What you are testing

You want to see what happens in the seconds after the VPN disconnects unexpectedly. A working kill switch means no traffic leaves your device and your real address never appears. A failing one lets traffic flow normally and your real address shows up.

Step 1: Know your real address

With the VPN off, open the home page or run the command below, and write down your real public address.

curl https://scanmyprivacy.com/api/ip

Step 2: Turn the kill switch on

Open your VPN app's settings and enable the kill switch, sometimes called "network lock" or "always-on VPN". Some apps have two modes (soft and strict), so pick the strict one for the test. Then connect to a server.

Step 3: Start a repeating check

Run a command that asks for your public address every second.

macOS or Linux:

while true; do date +%T; curl -s -m 2 https://scanmyprivacy.com/api/ip; echo; sleep 1; done

Windows PowerShell:

while ($true) { Get-Date -Format T; try { (Invoke-WebRequest -UseBasicParsing -TimeoutSec 2 https://scanmyprivacy.com/api/ip).Content } catch { "no connection" }; Start-Sleep 1 }

You should see the VPN server's address on every line.

Step 4: Break the connection

Do not click Disconnect in the VPN app, because that is an intentional disconnect and the kill switch is designed to let it through. Instead, simulate a failure: kill the VPN process in Task Manager or Activity Monitor, or block the VPN server with a firewall rule, or switch Wi-Fi off and on.

Step 5: Read the result

  • "no connection" or timeouts, then the VPN address again after reconnect: the kill switch works.
  • Your real address appears even once: it failed. Anything that leaks for a second is enough to be logged.

Stop the loop with Ctrl+C when you finish, and reconnect the VPN.

If the kill switch fails

  1. Check you enabled the strict or always-on mode, and that you have the latest app.
  2. Try another protocol, such as WireGuard or OpenVPN, as support differs.
  3. Use the VPN leak checklist to look for other leaks, including DNS.
  4. If it keeps failing, use a firewall rule that blocks all traffic except to the VPN server, or switch provider. Be cautious with free apps; see free VPN risks.

Tools that can help

VPNs

What it does: Replace the IP address websites see with the VPN's, and encrypt traffic between your device and the VPN. Useful on untrusted networks. What it does not do: Stop phishing, malware, browser fingerprinting or tracking by sites you log in to. The VPN company can see your traffic instead, so choose one you trust and avoid free services you cannot vouch for.

  • Proton VPNFree tier and paidNo commissionVPN with a free plan (fewer servers) and paid plans. Visit site
  • Mullvad VPNPaidNo commissionPaid VPN that does not ask for an email address to sign up. Visit site
  • Our VPN partnerPaidAffiliate: we may earn a commissionThe VPN we have an affiliate arrangement with. Compare it with the options above before you buy. See the offer

Items marked Affiliate pay us a commission if you buy, at no extra cost to you; they never change what our tests report or the order of free options. How we choose.

Keep reading

How to Check If Your VPN Is Leaking Your IP AddressA five-minute checklist to test your VPN for IP, DNS, WebRTC and IPv6 leaks, and what to do if any test fails. Free tools, no sign-up.Do VPNs Leak DNS?Why a VPN can still leak your DNS requests to your ISP, the common causes (IPv6, Windows, browser DoH) and how to test for and fix a DNS leak.Are Free VPNs Safe?Why free VPNs are risky, how they make money, documented cases of abuse and what to use instead if you cannot pay. Includes a checklist to evaluate any VPN.VPN vs Proxy vs TorVPN vs proxy vs Tor compared: what each hides, who can still see your traffic, speed, cost and which to choose for streaming, privacy or anonymity.What Is an IPv6 Leak, and How Do You Fix It?An IPv6 leak exposes your real address even while a VPN shows connected. Learn how it happens, how to test for it and three ways to fix it.Why Does My IP Address Show the Wrong Location?IP geolocation is an estimate, not a GPS fix. Learn why sites show the wrong city or even country for your IP address, and what you can do about it.

Frequently asked questions

Is it safe to test my kill switch?

Yes. You are only checking your own connection, and reconnecting the VPN or toggling Wi-Fi puts everything back as it was.

Does the kill switch also work when my computer sleeps?

Not always. Test that too: sleep and wake the computer with the repeating check running, and see whether the real address appears for a moment.

What is the difference between a kill switch and a leak test?

A leak test checks that nothing leaks while the VPN is connected. A kill switch test checks that nothing leaks at the moment the VPN fails. You need both.