Yes, a browser virtual private network (VPN) hides your public Internet Protocol (IP) address from a website when the request goes through its server: the website sees the server's address. The extension usually routes only its own browser's requests through the proxy. Other applications may still connect directly, and individual browser connections require additional checks. A single changed address on a test page is not enough.
What address the website should see
A proxy is an intermediary: the browser passes the request to it, and the proxy connects to the website. Without such an intermediary, a system-level VPN or another relay, the website sees the public address of your connection (it may be shared by several subscribers). The browser's name itself hides nothing.
In Safari, the address may also be changed by iCloud Private Relay. Its specifics are covered in the guide for Safari.
| Connection method | What the website sees | What happens with other applications |
|---|---|---|
| Direct connection | The public IP of the connection | They use their own route |
| Extension with a proxy | The proxy's IP for requests routed through it | They usually continue to connect directly |
| Built-in browser feature | The intermediary's IP for the sites it covers | Protection for the whole device does not follow from this |
| System-level VPN | The server's IP for traffic inside the tunnel | They may use the tunnel if included in its route |
More about the scope of connections: what a browser VPN does and how it differs from an app.
First compare the IP in two browsers
Carry out the comparison on the same device and on the same network: switching from home internet to mobile changes the address by itself.
- Original address: disable the extension on your personal device and open an IP checking page (search for "ip check"). Write down the IPv4 and IPv6 addresses if both versions are shown. With a system-level VPN enabled, these may already be its server's addresses.
- Address after connecting: enable the extension and refresh the same page. Compare the addresses: the country on the map may be determined inaccurately.
- Check outside the extension: open the same page in another browser without the add-on, or check the address using another application.
- Repeat the check: repeat the comparison after changing the server or settings. Check a private window separately.
Example situation: Chrome shows the extension's server address, while a second browser shows the original one. For a browser proxy this is the expected result. It confirms the route of a particular request; exceptions for individual sites and other connections remain unverified.
What to check if the original IP remains
In Chrome, open the internal page chrome://net-internals/#proxy and look at the active settings — the Effective settings field. Compare them with the original ones (Original). The sources of the settings may be extensions, launch parameters, the system and organisation policies (Chromium documentation).
In Edge, check the active proxy as well. Internal pages change between versions: if the section is unavailable, check the extension and compare the IP. Permissions are covered in the guide for Chrome and Edge.
Check the automatic proxy configuration (PAC), the script that selects the route. If it fails to load, Chrome usually switches to DIRECT — a direct connection. With mandatory PAC, an error occurs instead. Sites excluded in the settings may also open directly.
Can WebRTC reveal the original address?
Web Real-Time Communication (WebRTC) is the technology behind browser calls and data transfer. To find a working connection, it uses, among other things, service address discovery requests (STUN). These requests may take a different path from the open web page.
RFC 8828 describes a specific risk: if the browser uses a proxy but direct internet access is allowed, STUN checks may bypass the intermediary and reveal the public IP of the connection. By default, the document does not provide for WebRTC traffic to be sent through a proxy.
The behaviour of a particular browser depends on its implementation, settings and camera and microphone permissions. The RFC is no substitute for testing it.
Run a WebRTC check (search for "webrtc test") with the extension enabled. Compare the public addresses with the original IPv4 and IPv6: a match shows that the address was disclosed in the test. A local address on your home network is not equivalent to a public IP.
Disabling WebRTC entirely may break browser calls. After changing the settings, also check the communication service you actually need.
Why DNS and UDP are checked separately
The Domain Name System (DNS) translates a site's name into an address. An IP check does not show who performed the translation: with local name resolution, DNS queries may bypass the proxy.
| Setting | Where the site's name is resolved | What to check |
|---|---|---|
| HTTP proxy in Chrome | On the proxy, for the proxied request | Whether the proxy applies to the site in question |
| SOCKS5 in Chrome | On the proxy, for the proxied request | Whether there is a direct route or an exception |
| SOCKS4 in Chrome | On the device | Where local DNS queries go |
| SOCKS in Firefox | Depends on proxyDNS | The setting of the proxy mechanism in use |
Here HTTP denotes the protocol for transferring web requests; SOCKS is a protocol used by proxy servers. In Firefox, the proxyDNS parameter controls name resolution through SOCKS. In the object an extension uses to set the route for an individual request, its default value is false; in the general proxy settings for SOCKS5, it is true. Check which mechanism is in use with the guide to DNS and the Firefox proxy and Mozilla's documentation.
SOCKS5 in Chrome forwards web requests over the Transmission Control Protocol (TCP) but does not support the User Datagram Protocol (UDP). The QUIC transport runs over UDP and is therefore not covered by such a proxy. This alone does not prove a leak: the request may switch transport or fail.
How to choose the next step based on the results
Proceed according to the test results:
- The IP in the browser is unchanged: check the connection, the active proxy settings, exceptions and permissions for the window in use. Then repeat the IP check.
- The IP changed only in the browser: the extension covers the tested browser request. If you need other applications covered as well, move to a system-level connection.
- WebRTC revealed the original public address: check restrictions on direct connections or a system-level tunnel. Repeat the test and check your calls.
- The addresses look as expected: check the DNS settings. The result applies only to the configuration you tested.
If you need a system-level tunnel but some applications must connect directly, I recommend considering CitadelVPN via a compatible client with split tunnelling. This determines which traffic is routed through the connection. First check support for the rules you need: the availability of a "browser only" mode depends on the client and platform. Then repeat the IP comparison in the browser and another application, plus the WebRTC test.
Frequently asked questions
Does a different IP on the test page mean I am protected?
It confirms the address has changed for the request you tested. The website may still identify you through cookies, account logins or your browser fingerprint. Changing the IP does not remove these markers.
Why do sites keep opening when the extension fails?
A fallback to a direct connection is possible, for example when an optional PAC script fails to load. The mere fact that a page loads does not confirm the proxy is working: compare the address and the active settings again.
Does a system-level VPN hide the IP better than an extension?
It can cover more connections, including other applications' traffic. For such a task, choose a system-level connection, checking the exceptions and the actual route. Wider coverage is no substitute for IP, WebRTC and DNS tests.
What counts as a confirmed result
A browser VPN hides your original IP from a website for requests that pass through its server. To verify your own connection, compare the address before and after enabling it, repeat the test outside the extension, check the active proxy, WebRTC and the way DNS is resolved. A changed IP in one browser only confirms the route you tested; to cover other applications, you need a properly configured system-level tunnel.