How to Test Your VPN: Speed, Leaks, and Stability
Key points
- Measure your bare connection first, because every VPN result only means something against that baseline.
- Keeping 85 to 95 percent of your speed with a nearby server is a good result.
- Verify the IP change, then run DNS and WebRTC leak tests in every browser you use.
- Trip the kill switch on purpose once, and rerun the two minute checks after major updates.
On this page
- The Fifteen Minute Test Plan
- Step 1: Establish Your Baseline
- Step 2: Test Speed Through the Tunnel
- Step 3: Confirm Your IP Address Changed
- Step 4: Check for DNS Leaks
- Step 5: Check for WebRTC Leaks
- Step 6: Test the Kill Switch
- Step 7: Let It Run for a Day
- Repeat the Leak Tests on Other Networks
- The Two Minute Quick Version
- What good results actually look like
- Summary
- Frequently asked questions
A VPN makes promises you cannot see. The app says connected, the icon looks right, and you take the rest on faith. You should not have to. Every important claim a VPN makes, that your traffic is tunneled, that your lookups do not leak, that drops will not expose you, can be tested from your couch in about fifteen minutes.
This guide is that test, in order. Run it once after setup, and the short version again after big updates. By the end you will know your VPN's honest speed cost, whether anything leaks, and whether the safety net actually catches you.
The Fifteen Minute Test Plan
| Test | What it proves | Time |
|---|---|---|
| Baseline speed test | What your connection does without the VPN | 2 minutes |
| VPN speed test | The tunnel's real cost on your connection | 3 minutes |
| IP address check | Traffic actually exits at the server | 1 minute |
| DNS leak test | Name lookups travel inside the tunnel | 2 minutes |
| WebRTC leak test | Your browser does not reveal your real address | 2 minutes |
| Kill switch test | Drops block traffic instead of exposing you | 3 minutes |
| Stability check | The tunnel survives a normal day | Passive |
Step 1: Establish Your Baseline
Disconnect the VPN and run a speed test. Write down three numbers: download, upload, and latency. This is your baseline, and every later judgment depends on it. A VPN result only means something compared to what your connection does bare, on the same network, at the same time of day.
If the baseline itself looks bad, stop and fix that first. A VPN cannot outrun the connection underneath it.
Step 2: Test Speed Through the Tunnel
Connect to your nearest server with a modern protocol and run the same test. Honest expectations: with a nearby server, keeping 85 to 95 percent of your baseline download is a good result, and latency should rise by only a few milliseconds. Some loss is normal, because encryption and the extra hop are real work. Zero loss would mean the test is broken.
Now repeat once with a distant server, just to see the difference. Latency will jump with distance, and throughput usually sags. That is physics, not a defect. If your nearby result is poor, work through the fixes in our guide to diagnosing a slow VPN before blaming the service. For the finer points of fair measurement, including time-of-day effects, see the VPN speed guide.
Step 3: Confirm Your IP Address Changed
Search "what is my IP" with the VPN off and note the address and location shown. Connect, refresh, and check again. You should now see the VPN server's address and its city, not yours. This one minute check confirms the basic promise: websites see the server, not your home connection.
If the address did not change, the tunnel is not carrying your browser traffic at all. Check that the app is connected and that no other network software is overriding it.
Step 4: Check for DNS Leaks
Your device translates site names into addresses through DNS, and those lookups should travel inside the tunnel. If they slip outside, your internet provider still sees every site name you request, which quietly defeats the privacy you wanted.
Run a DNS leak test site while connected. The resolvers it lists should belong to your VPN provider, not your home internet provider. If you see your provider's name in the results, you have a leak. Fixes and the full explanation are in our DNS leak guide.
Step 5: Check for WebRTC Leaks
WebRTC is the browser technology behind in-page video calls, and it can reveal your real IP address to websites even with the tunnel up, because it negotiates connections in a way that bypasses normal routing. A WebRTC leak test page shows every address your browser exposes. With the VPN connected, your real home address should not appear anywhere on that page.
If it does, your VPN app or a browser setting needs adjusting. The mechanics and the fixes are covered in our explainer on WebRTC leaks.
Step 6: Test the Kill Switch
The kill switch is the feature that blocks traffic when the tunnel drops, and it is exactly the kind of thing to test before you need it. With the VPN connected and the kill switch enabled, turn your Wi-Fi off for ten seconds, then back on. Watch what happens: traffic should stay blocked until the tunnel re-establishes, and nothing should sneak out over the bare network in between.
An open IP check page makes this visible. If it refreshes with your real address during the gap, the switch failed. Setup details per platform are in our kill switch guide.
Tip: write your results down somewhere you will find them again, baseline speed, VPN speed, and the date. Six months from now, when something feels off, those three numbers turn a vague suspicion into a clear comparison.
Step 7: Let It Run for a Day
The last test is passive. Leave the VPN on through a normal day of use: commute, network switches, laptop sleep and wake, video calls. A good setup survives all of it without you noticing. Signs of trouble are repeated reconnect notifications, apps that stall after your phone wakes, or the tunnel silently dropping and staying down.
If a particular server keeps misbehaving, check whether it is a known issue before changing your setup. We publish per-location health on our server status page, and a degraded server is a reason to switch, not a reason to troubleshoot your own device for an hour.
Repeat the Leak Tests on Other Networks
One pass at home is not quite the full story. DNS behavior can change with the network, because some routers and captive portals push their own resolvers onto your device when you join. A setup that shows no leaks on your home Wi-Fi deserves one more check from your phone's mobile data and from one public network, like a cafe.
The good news is that only the leak tests need repeating, not the whole routine. Connect the VPN on the new network, run the DNS check, and glance at the IP check. Two minutes per network buys you confidence that the protection travels with you, which is the entire point of having it on a phone.
The Two Minute Quick Version
After app updates, system upgrades, or setting changes, you do not need the full routine. Run the short loop: connect, confirm the IP address changed, run the DNS leak test. Those two checks catch the most common regressions, and they take about two minutes together. Do the full routine again only when you change devices or providers.
What good results actually look like
Once you have run the tests, the next question is simple: are these numbers normal, or is something wrong? Start with speed. A drop of roughly 10 to 30 percent through a nearby server is typical and nothing to worry about. Some slowdown is the price of routing your traffic through an extra hop. If you lose more than half your speed, that usually points to a distant or busy server, or another issue worth looking into. Try a closer server and test again before you blame vpn.now.
Ping works the same way. A small rise on a close server is expected. Large ping jumps almost always mean the server is far from you, so the signal has farther to travel. If you are gaming or on calls, picking a nearby server keeps that delay low.
The leak checks are different. They are pass or fail, with no middle ground. Your public IP should show the VPN location, not your real provider. Your DNS check should show the VPN as well. If either one still shows your own provider, that is a fail, even if everything else looks great. The kill switch test is also pass or fail: it passes only if your traffic fully stops the moment the tunnel drops. Anything leaking through during that gap means it did not work.
Keep in mind that exact numbers depend on your base connection, the server you pick, and the time of day. Compare your results against your own baseline, not someone else's screenshots. The healthy result you are looking for is a modest speed cost paired with clean leak checks. That combination means your connection is doing its job.
Summary
Testing a VPN comes down to a few honest checks:
- Measure your bare connection first. Every VPN result is relative to that baseline.
- Expect to keep 85 to 95 percent of your speed with a nearby server on a modern protocol. Some cost is normal.
- Verify the IP change, then test DNS and WebRTC leaks. A leaking tunnel is worse than no tunnel, because it feels safe.
- Trip the kill switch on purpose once. A safety net you have never tested is a guess.
- Record your numbers, and rerun the two minute version after major updates.
You can run this entire routine on the vpn.now free plan before deciding whether a paid tier is worth it, which is exactly the order we would test things in too.
