The word leak is doing three jobs
Open two leak tests on the same connection and they often disagree. One says leaked. The other says clean. A third prints a city and a score and never says which question it asked.
They are not measuring the same thing. A private tunnel address, a public DNS resolver, and a second public IP are three outcomes. Sites that use one word for all three send people to the wrong fix.
The names people already trust are dnsleaktest.com, browserleaks.com, and ipleak.net. Keep them. Read them next to a page that separates the three outcomes. That page is the six checks. Each section below is one check, and the link is the live test, not a screenshot.
WebRTC: a red local address is usually the tunnel
BrowserLeaks lists host, server-reflexive, and relay addresses in one place. That is useful if you already know which kind is which. It is how a VPN adapter's private address gets read as "my real IP".
A leak is a public address that is not the address the page loaded from. Addresses in the private ranges, the carrier range, a link-local address, and a .local name are not reachable as your public IP. The WebRTC leak test labels each kind and compares the public ones with the page address. A relay is not you. A tunnel address is not a leak.
ipleak is the wide page: WebRTC, DNS, and more on one screen. Use it when you want the pile. Use the labeled test when the pile has a private address in red and you need to know whether that red is the finding.
DNS: Cloudflare on the list is not automatically your ISP
dnsleaktest's extended test and a shorter test do not list the same resolvers. One of them can include a validator that touched a DNSSEC check. People then read "Cloudflare" and decide the VPN failed.
A public resolver is a fact. It is not, by itself, a leak. Chrome's Secure DNS and Firefox's DNS over HTTPS send lookups to Cloudflare or Google even while a proxy or VPN is up. The IP looks like the exit. The DNS does not. The DNS leak test names the resolver, compares its network with the network this page loaded from, and says when Secure DNS is the likely reason. Twelve lookups are the normal test, not a second button.
If the resolver's network is your home ISP and the page address is the proxy, that is the leak. If the resolver is 1.1.1.1 and you turned Secure DNS on, turn it off and run the test again before you blame the tunnel.
The address: a city is a guess
Two IP sites show two cities because they bought two databases and printed the guess as a location. Compare the address and the network name. If those differ, one of the sites is not seeing the same connection.
The IP lookup stops at the country and the network operator. The score on that page starts at 100 and names every point it takes off: hosting, a time zone that disagrees with the country, a language that disagrees, a second public WebRTC address, a DNS resolver on another network, SpamCop, DroneBL. A check that did not run is left out. It is not called clean. The bars for large sites are those same checks with different weights. Those companies do not return that percentage.
Fingerprint: a green hash is not safety
A hash is an id two libraries can compute. It does not say how rare the browser is. A uniqueness percentage next to a green hash is how a mismatched clock and a second public address get ignored.
Sites flag contradictions: the clock against the country, the language, the platform, a replaced value, a public WebRTC address. Brave, Firefox with fingerprint resistance, and Tor coarsen values on purpose. That is a privacy browser, not a broken one. The browser fingerprint test leads with those disagreements and does not print a uniqueness score.
Automation is not the same as a privacy browser
A lot of bot tests treat a coarsened fingerprint as a program driving the browser. The flag that matters is the one the browser sets when a test runner is controlling it. Timing the debugger, so an open DevTools window freezes the tab and counts as a bot, flags the person reading the result.
The bot detection test has three answers: a normal browser, a privacy browser, or automation. The signal that decided it is named.
A proxy list is headers, not an elite badge
Checkers invent elite, anonymous, and transparent, and they disagree with each other. The useful line is the forwarding header the proxy actually sent, the exit address, and the latency. If another public address is in a header, that address was disclosed. If it is not, it was not.
The proxy checker takes a list you paste. HTTP, HTTPS, SOCKS4, SOCKS5. The password is used for that check and dropped. It does not belong in the result you copy.
Read them as a set
A result means more next to the others. The page address, WebRTC, and DNS disagreeing is the finding. Run the six checks on one page, in the order that needs no typing first. The checklist for an antidetect or proxy profile is the 2027 pass.
dnsleaktest, browserleaks, and ipleak stay worth opening. When they disagree with this set, the disagreement is the label, not a second internet.