/ PEIRA
Does the protection you
think you have exist?
Peira tests your own machine's configuration across three dimensions: whether outbound traffic would leak, whether anything can reach you from the network, and whether the browser discloses addresses where the operating system cannot see. Every finding traces back to our published measurement research.
Why it exists
Failure gives no signal
When a tunnel disappears, applications keep working and pages keep loading — while every packet leaves with your real address and never stops. Our controlled measurements show this failure mode produces no indication at all.
Test pages see only a sliver
A VPN vendor's own leak-test page looks once, from the browser, at the moment you open it. Whether the tunnel interface still exists, what the kill switch permits, which traffic the tunnel never governed — those are only visible from inside your system.
Conclusions you can check
Each finding is labelled with the measurement scenario it comes from, traceable to our published report and data. What cannot be determined is reported as undetermined, never dressed up as a pass.
What it checks
Three dimensions: after traffic leaves, before anything reaches you, and inside the browser where the operating system cannot see.
| Whether the tunnel actually carries traffic | An interface existing is not the same as traffic using it |
|---|---|
| The fallback path if the tunnel vanishes | Reroute to the physical interface, or blocked |
| Whether IPv6 bypasses the tunnel | The easiest thing to miss while IPv4 tests look clean |
| Where DNS queries go | Protected traffic content does not mean a protected list of destinations |
| Whether queries are encrypted in transit | A public resolver is not the same as encryption |
| The kill switch and its exceptions | A local-network exception is itself an attack surface |
| What the tunnel cannot protect | ARP, DHCP, mDNS — no VPN stops these |
| Your actual exit address and network | Who the outside sees |
| Services reachable from the network | "I did not set up a server" does not mean nothing is listening |
| WebRTC exposure in the browser | This path bypasses the OS; a firewall cannot stop it |
Privacy
Peira contacts no server by default; the report stays on your machine and it runs fully offline. The single exception is egress verification, which you enable explicitly, and every address it contacted is listed at the end of the report. There is no telemetry and no account.
Pricing
Free
Free
- The complete one-off check (every probe)
- Exit address and network verification
- Local interface and terminal output
- Reports in three languages, JSON output
- No account required
Coming soon
Pro
US$29/year
- Everything in Free
- Continuous monitoring: re-checks the moment the network changes
- Alerts on state change (webhook / custom command)
- History and trends
- Starts automatically at login
- Email support
Coming soon
Team
Contact us
- Everything in Pro
- Multi-device licensing
- Audit-ready report format
- Onboarding and training
- Pairs with our defense services
Coming soon
Pro licences are verified offline. No account is created and no usage is reported. When a licence expires, the full free tier keeps working.
Download
Windows, macOS and Linux (including arm64). A single executable with no runtime to install. Releases ship with SHA256 checksums and a GPG signature — verify before you run it. A tool for verifying protection should itself be verifiable.
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missingIn final testing before release. To hear when it ships, email contact@odysec.org.