Methodology
How MyLeaks tests work
MyLeaks reports observations made during the current page load and its associated network connections.
Scope and interpretation
Results can be affected by browser behavior, privacy controls, VPNs, proxies, NAT, firewalls, and other network software. Read each result together with its stated limitations.
1. IP & Geo
What we measure
The HTTPS connection source IP, its IPv4 or IPv6 version, negotiated TLS version and cipher, User-Agent, Accept-Language, and low-entropy Client Hints (Sec-CH-UA, Sec-CH-UA-Mobile, and Sec-CH-UA-Platform). The result may also include country, subdivision, city, approximate latitude/longitude, accuracy radius, timezone, ASN, and AS organization when available.
How we measure it
MyLeaks reads the source address and connection details observed for the current visit. Approximate location and network fields are looked up from IP reference data.
What the result means
The public IP is the address observed for the HTTPS request reaching MyLeaks. Geo and network fields are database estimates associated with that IP address, not device-reported location.
Limitations
VPNs, forward proxies, carrier-grade NAT, corporate gateways, and other routing can change the observed address. IP databases can be missing, stale, or geographically imprecise. This test does not request GPS or other device location permission.
2. Proxy/VPN detection
What we measure
Classification indicators about the observed public IP, including proxy, VPN, Tor, hosting/datacenter, residential-proxy, network type, operator, confidence, and risk fields when available.
How we measure it
MyLeaks checks the current public IP against network classification data and presents the available indicators in a consistent format.
What the result means
Detected means an indicator was found for the current IP. Not detected means no indicator was found in this check. Unknown means the required information was unavailable or insufficient.
Limitations
Classification data can be incomplete, delayed, or stale. Network categories overlap and can conflict, especially for shared hosting, relays, and newer services.
3. WebRTC
What we measure
ICE candidate type, address, port, protocol, related address/port, TCP type, and whether the address is numeric public, numeric private/local, an mDNS-obfuscated .local name, or another hostname. Counts are shown for host, server-reflexive (srflx), relay, peer-reflexive, and unknown candidates.
How we measure it
The page creates a WebRTC connection, opens a data channel, and gathers ICE candidates until the browser finishes or the test times out. It does not request camera or microphone access. Structured candidate fields are preferred, with raw candidate parsing as a fallback.
A host candidate represents an interface address or its mDNS replacement. A server-reflexive candidate is the mapped address learned during connection setup. A relay candidate routes through TURN and is displayed but excluded from direct public-IP comparison. Private/local and mDNS host candidates are reported separately.
What the result means
MyLeaks compares numeric public host or server-reflexive addresses with the public HTTP address. A difference reports that the browser exposed another public address. A match means only that this test found no different public address.
Limitations
Browser policy, extensions, enterprise controls, VPN routing, firewalls, and browser versions can change candidate exposure. Relay candidates are excluded from direct public-IP comparison. An unavailable result means the test did not obtain a usable comparison. This is not a dedicated IPv6 connectivity test.
4. DNS
What we measure
The resolver-egress IP addresses that query unique test names, IP version, query types and counts, number of observed probes, and country/ASN information when available.
How we measure it
The browser resolves several unique names and waits briefly for observations. If the first method produces no result, a second browser-supported resolution method is attempted before the test times out.
What the result means
An observed address is a recursive resolver or resolver-egress address that queried MyLeaks’ authoritative DNS infrastructure. The result shows relationships between that resolver network and the HTTP network.
Limitations
The result may not be the exact DNS server configured on the device and does not identify the browser’s DoH/DoT setting. Shared, forwarding, anycast, and public resolvers are common. Browser or network behavior can suppress test requests.
5. TLS JA3/JA4
What we measure
The observed TLS ClientHello: legacy and supported TLS versions, cipher-suite order, extension order, supported-group order, EC point formats, signature algorithms, ALPN values, and SNI presence. MyLeaks derives JA3 and JA4 TLS Client values.
How we measure it
MyLeaks parses the ClientHello observed for the test connection and derives both fingerprints from the same ordered protocol fields.
What the result means
JA3 and JA4 summarize characteristics of the ClientHello that reached MyLeaks. They can help compare TLS implementations or paths, and many clients can share the same values.
Limitations
TLS interception, proxies, middleware, browser updates, and configurable TLS libraries can change the observation. Many clients share fingerprints.
Advanced details: JA3 and JA4 normalization
JA3 uses legacy_version,ciphers,extensions,supported_groups,ec_point_formats. GREASE is removed from ciphers, extensions, and groups; remaining order is preserved. Values are decimal and hyphen-separated inside each field. Its identifier is lowercase MD5 of that canonical string, as the JA3 format specifies.
JA4 uses the highest non-GREASE offered supported version, falling back to the legacy version; the TCP transport marker; SNI present/absent state; capped two-digit counts of non-GREASE ciphers and extensions; and a code from the first ALPN entry. That ALPN code uses its first and last bytes when both are ASCII alphanumeric; otherwise it uses the first and last hexadecimal characters. Cipher IDs are sorted numerically and SHA-256 hashed to a 12-hex prefix. Extensions remove SNI (0x0000) and ALPN (0x0010), then sort numerically. Ordered, non-GREASE signature algorithms are appended without sorting before the second 12-hex SHA-256 prefix. Empty hash input uses twelve zeroes. MyLeaks implements JA4 TLS Client, not other JA4+ methods.
6. HTTP/2
What we measure
The client preface and ALPN h2, first non-ACK SETTINGS entries, bounded initial non-ACK frame sequence, connection WINDOW_UPDATE increments and sequence positions, pseudo-header order, and regular header-name order. Stream window updates, priority data, and header-block flags are shown as details.
How we measure it
The browser opens an HTTP/2 connection. MyLeaks parses the initial frames and header block and returns the observation for that connection.
What the result means
myleaks-h2-v1 is a MyLeaks-specific, versioned summary of the observed HTTP/2 startup behavior. It is not JA4H, Akamai fingerprinting, or a universal standard.
Limitations
Some proxies, corporate networks, firewalls, and restrictive gateways can block the test connection. Intermediaries can alter behavior, and many clients can share the same result.
Advanced details: myleaks-h2-v1
myleaks-h2-v1|SETTINGS=<id:value,id:value,...>|WINDOW=<increment@sequence-position,...|none>|FRAMES=<non-ACK-frame-name,...>|PSEUDO=<pseudo-header-name,...>|HEADERS=<regular-header-name,...>
SETTINGS entries, frame names, pseudo-header names, and regular-header names preserve observed wire or decoded order; duplicates and unknown setting IDs remain. Unknown frames use UNKNOWN_0xNN. The fingerprint is lowercase SHA-256 of the exact UTF-8 canonical string. Header values, source address/port, timing, TLS fingerprints, and browser-local hashes are excluded.
7. QUIC/HTTP/3
What we measure
The direct QUIC connection’s public IPv4 address, QUIC version, exposed stable transport-parameter values, initial source/destination connection-ID lengths, HTTP/3 SETTINGS values, reserved-setting presence, request header-name order, and whether 0-RTT was accepted.
How we measure it
The browser attempts an HTTP/3 connection over QUIC. Only a successful QUIC and HTTP/3 observation is shown as a fingerprint.
What the result means
myleaks-quic-v1 and myleaks-h3-v1 are MyLeaks-defined summaries of exposed connection characteristics. A different HTTPS and QUIC IP means the two connections reached MyLeaks through different public paths; it does not say which address is “real.”
Limitations
QUIC or HTTP/3 can be blocked or disabled by the browser or network. Some transport details and wire ordering are unavailable, so MyLeaks omits them instead of inferring them. Many clients can share the same result.
Advanced details: MyLeaks QUIC and H3 canonicalization
myleaks-quic-v1 canonical input:
VER=<escaped-version>|TP=<numeric-id:value sorted by id>|GREASE=NE
The transport-parameter allowlist uses IDs 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 14, plus ID 32 when max_datagram_frame_size is present. Version text escapes % | , :. Parameter order, source address/port, raw CID/token bytes, timing, and dynamic connection data are excluded. NE means GREASE observation is not exposed.
myleaks-h3-v1 canonical input:
SETTINGS=<known numeric-id:value sorted by id>|GREASE=<0|1>
The V1 allowlist is SETTINGS IDs 1, 6, 7, 8, and 51. Unknown non-reserved settings are displayed but excluded. Reserved IDs matching 0x1f*N+0x21 contribute only the stable GREASE presence bit; their random IDs and values are not hashed. Both fingerprints are lowercase SHA-256 of their exact UTF-8 canonical input. 0-RTT is disabled and excluded.
8. TCP
What we measure
The raw TCP window, first valid MSS and window-scale values, SACK-permitted, timestamp and TCP Fast Open option presence, ECE/CWR state, IPv4 Don’t Fragment bit, and TCP option wire order. Observed TTL and estimated initial TTL/hops are displayed separately.
How we measure it
MyLeaks reads selected characteristics of the initial IPv4 TCP SYN and builds a versioned summary from stable fields.
What the result means
myleaks-tcp-v1 summarizes the initial SYN characteristics received by MyLeaks. It is a separate format from JA4T.
Limitations
NAT, VPNs, proxies, firewalls, packet normalization, and other network devices may change these fields. Many systems share the same result.
Advanced details: myleaks-tcp-v1
WIN=<raw>|MSS=<value|->|WS=<value|->|SACK=<0|1>|TS=<0|1>|TFO=<0|1>|ECN=<NONE|ECE|CWR|ECE+CWR>|DF=<0|1>|OPTS=<comma-separated option tokens|->
Known duplicate options remain in option order; the first valid MSS/window-scale value wins. NOP and EOL remain. Unknown options use OPT<kind>L<length>, without option data. Malformed lengths reject the SYN. The fingerprint is lowercase SHA-256 of the exact canonical string.
The hash excludes flow addresses/ports, sequence and acknowledgement numbers, IP ID, TTL/hop estimates, TCP timestamp values, TFO cookie bytes, checksums, and capture time. Observed TTL is compared with the smallest common initial value among 32, 64, 128, and 255; the resulting TTL and hop values are estimates only.
9. Browser fingerprint
What we measure
Seven separate browser-exposed surfaces: Canvas, WebGL, WebGPU, Audio, Fonts, ClientRects, and Canvas TextMetrics. There is no single composite browser fingerprint. Each surface is measured twice to test same-page stability.
How we measure it
The page uses browser capabilities and SHA-256 hashing. Object keys are recursively sorted before JSON serialization; arrays retain their defined order.
What the result means
A surface marked stable produced the same hash in its two runs during this page load. This status describes repeatability during the current load.
Limitations
Availability and values depend on browser, operating system, graphics and audio implementation, fonts, privacy defenses, extensions, and runtime state. Restricted or unstable results do not by themselves establish privacy, spoofing, or authenticity.
Advanced details: exact input to each browser hash
- Canvas: raw RGBA bytes from a deterministic 320 × 160 Canvas 2D scene containing fixed fills, compositing, geometry, gradients, and text. SHA-256 is applied directly to the pixel bytes.
- WebGL: raw RGBA bytes read from a fixed 96 × 96 WebGL 2, WebGL 1, or experimental WebGL triangle render. Displayed capability data—context/version, shading language, vendor/renderer, optional unmasked values, selected limits, antialias, and sorted extension list—is not part of this rendering hash.
- WebGPU: canonical JSON containing adapter info (
vendor,architecture,device,description, or “Not exposed”), lexicographically sorted feature names, and a fixed ordered list of finite numeric WebGPU limits. Object keys are sorted during canonical serialization. - Audio: 8,192 samples (frames 1024–9215) from a one-channel 44,100 Hz offline render of a 997 Hz triangle oscillator through a compressor with fixed parameters. Each Float32 is encoded little-endian before SHA-256; no audible output or permission request is used.
- Fonts: canonical JSON with the fixed candidate-list count and lexicographically sorted detected names. A font is detected when fixed probe-text width or height differs from at least two of the serif, sans-serif, and monospace fallback baselines.
- ClientRects: canonical JSON for a fixed 320 px off-screen layout: root, box and inline bounding/client rectangles, plus text Range rectangles. Coordinates are relative to the container and fixed to six decimal places; array order is preserved.
- TextMetrics: canonical JSON with precision 6 and three fixed font/text cases. For each case, the supported finite values of width, actual bounding-box left/right/ascent/descent, and font bounding-box ascent/descent are included in a fixed property order and fixed to six decimal places.
10. Consistency checks
What we measure
The rules compare: HTTP IP with public WebRTC candidates; browser timezone with IP-estimated timezone; resolver ASN/country with HTTP ASN/country; logical relations within IP-intelligence evidence; User-Agent family/version with Client Hints; User-Agent, Client Hints and navigator.platform; mobile markers; per-surface fingerprint stability; navigator.webdriver; and HTTPS IP with QUIC IP.
How we measure it
The consistency rules compare results already produced by the page without repeating the tests. Platform aliases and compatible browser-family representations are normalized conservatively; timezone offsets use one reference instant and browser Intl handling.
What the result means
Statuses such as consistent, compatible, mismatch, warning, informational, and unknown describe a specific factual relationship between the compared values.
Limitations
Open a mismatch to see which values differ. Missing inputs produce unknown results, and independently observed signals can differ because of network or browser behavior.