Everything runs on your machine — your input is processed right here in your browser and never uploaded to any server.
Enter the server URI: stun:host:port for STUN, or turn:host:port (also stuns:/turns:) for TURN.
For TURN, add the username and credential — allocations are always authenticated.
Click Check server: candidates stream in live as ICE gathers, each with its type, protocol, address and timing.
Read the verdict chips: STUN working shows your public address; TURN working shows the allocated relay address.
If it fails, the ICE error code pinpoints why — unreachable host, blocked UDP, or rejected credentials.
When WebRTC calls fail to connect, the STUN or TURN server is the first suspect — and testing one usually means digging out the trickle-ICE sample page or writing throwaway code. This checker does it in one click: it runs a genuine ICE gathering round in your browser against the server you enter and shows every candidate as it arrives, with millisecond timing.
The candidates tell the story. A server-reflexive candidate proves the STUN server answered and shows the public IP address it saw you as — useful for NAT debugging on its own. A relay candidate proves your TURN server accepted the credentials and allocated a relay — the thing that actually rescues calls on hostile networks. And when something is wrong, the ICE error codes (701 unreachable, 401/438 bad credentials) are shown instead of a silent hang.
100% private“The check talks only to the server you specify, using the browser’s own WebRTC stack. Your candidate addresses are displayed locally and never reported anywhere — this site has no server to send them to.”
That the server answered a STUN binding request and returned your public address — the server-reflexive candidate shown. It means the server is up, the port is reachable, and UDP (or TCP for stuns:) passes your network.
The server rejected the credentials. For static-auth servers check the username/password; for time-limited credentials (coturn’s use-auth-secret, Cloudflare TURN) the username embeds an expiry timestamp — expired credentials produce exactly this error.
Error 701 means no response at all: wrong host or port, the server actually being down, or — very commonly on corporate and hotel networks — UDP being blocked entirely. Try the TCP variant (turn:host:3478?transport=tcp) or a turns: listener on 443 to distinguish a dead server from a hostile network.
Yes — run the check once per variant: turn:host:3478 (UDP), turn:host:3478?transport=tcp, and turns:host:5349 or :443 (TLS). Whichever produces a relay candidate is a transport your network permits; on locked-down networks turns: on port 443 is usually the last one standing.