Definition
A VPN leak is any failure of the VPN to fully isolate the user's traffic from the open internet. Common types include DNS leaks (queries sent to the local ISP rather than the VPN's resolver), IPv6 leaks (IPv6 traffic bypassing an IPv4-only tunnel), WebRTC leaks (browsers exposing the local IP to JavaScript), and reconnect leaks (brief windows during which traffic flows outside the tunnel before the kill switch engages).
Why Leaks Matter
A leak undermines the entire purpose of running a VPN. A user who believes they are anonymous because they see the VPN's IP in a browser may be revealing their real IP via WebRTC to every site they visit; a user who believes their browsing is private may be sending every DNS query to their logging ISP. Leaks turn perceived security into a false sense of security, which is arguably worse than no security at all.
Detection and Defence
Tools like ipleak.net, dnsleaktest.com, and browserleaks.com test for the common leak categories. A well-built modern VPN client includes built-in leak protection: a strict kill switch, IPv6 blocking or tunnelling, DNS-over-VPN-only enforcement, and WebRTC mitigation guidance. Periodic re-testing is wise, particularly after operating system updates or VPN client updates, since changes in either can reintroduce leaks that were previously fixed.