Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWebRTC encrypts live media in transit: its security architecture uses DTLS-SRTP to establish keys for SRTP audio and video, and DTLS for data channels. But encryption is not the same as verifying who is on the other end, preventing a website from learning your IP address, or controlling what a page does with camera or microphone data after you grant access.
What WebRTC encryption protects
The IETF’s RFC 8827, WebRTC Security Architecture, describes browsers establishing keys through DTLS-SRTP for SRTP media. WebRTC data channels use DTLS. The architecture does not permit media to be sent as unencrypted RTP or RTCP. RFC 8834 likewise specifies the secured RTP profile with DTLS-SRTP keying as the mandatory media-security solution (RFC 8834, Media Transport and Use of RTP in WebRTC).
In practical terms, encryption is intended to keep an intermediary on the network from reading the media in transit. Eric Rescorla, author of RFC 8827, states: “Media traffic MUST NOT be sent over plain (unencrypted) RTP or RTCP; that is, implementations MUST NOT negotiate cipher suites with NULL encryption modes.” These are architectural requirements, not a guarantee that every browser or calling app has been independently tested against them here.
What encryption does not establish
It does not prove the other participant’s identity
A cryptographically protected connection does not, by itself, prove that the remote participant is the person they claim to be. The standards treat secure channel establishment and identity verification as separate questions. RFC 8827 describes options such as identity-provider authentication or an out-of-band comparison of a certificate fingerprint or short authentication string. Whether a call uses such a mechanism depends on the application and how participants verify one another.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
It does not make every endpoint trustworthy
The security architecture assumes the browser is trusted. If the browser itself is compromised, it cannot provide the intended guarantees. Encryption in transit also does not dictate what a website or application does with media after the browser makes it available to that page. Treat transport protection, endpoint security, and service practices as distinct parts of the privacy picture.
Camera, microphone, and screen-sharing permissions
RFC 8827 requires explicit consent before camera or microphone access, a clear indication while those devices are in use, and a user-accessible way to stop access. It also treats HTTP and HTTPS origins as separate permission domains and says HTTP origins must not receive permission grants. These are standards requirements; the exact permission prompts, indicators, and controls can differ among browsers and applications.
Rank #2
Screen sharing is a separate sensitive permission. The standard calls for a distinct request and an unambiguous indication of what is being shared. Before presenting, check the selected screen, window, or tab in the browser’s prompt, and stop sharing when it is no longer needed. Permission is authorization for the browser to make the selected media available to the page; it is not a guarantee about later handling by the site.
Can a WebRTC call reveal your IP address?
It can. ICE, the connectivity process WebRTC uses to find a route between participants, can disclose an IP address to the other participant. RFC 8827 describes delaying ICE negotiation until a user decides whether to answer and allowing an application to use only TURN candidates. With TURN-only routing, media travels through a relay, which can reduce disclosure of the user’s address to the peer. The tradeoff is potential added latency or reduced call performance.
That peer protection does not automatically hide your address from the calling service. RFC 8827 puts it plainly: “Hiding the user’s IP address from the server requires some sort of explicit privacy-preserving mechanism on the client (e.g., Tor Browser), and is out of scope for this specification.” A VPN or other client-side privacy mechanism changes the network path, but it should not be treated as proof that all identifying information is hidden. The relevant IETF discussion of IP handling and its privacy/performance tradeoffs is in RFC 8828.
How to assess a call’s privacy choices
There is no single privacy setting that answers every concern. Defaults and available controls vary by browser and app, so check the specific service rather than assuming that all WebRTC calls behave alike. Consider these questions:
Rank #4
- Who should not see your IP address? A peer and the calling service are different parties. TURN-only routing can help with peer disclosure; it is not, on its own, a way to hide your address from the service.
- Is traffic direct or relayed? A relay changes the route and can affect latency or quality. Ask whether the app offers a TURN-only option and what it covers.
- What is protected? Media encryption and signaling protection are separate considerations. Do not infer the coverage of one from the other.
- How is identity checked? Encryption protects a channel; look for an identity mechanism or agree on an independent verification method if knowing exactly who joined matters.
- What can the page access? Review device permissions and active-sharing indicators, and stop access when you are finished.
Persistent identifiers and call-to-call linkage
WebRTC security considerations include identifiers that may make separate calls linkable. RFC 8826 discusses the correlation risk from reusing DTLS certificates and RTCP CNAMEs; RFC 8827 describes generating fresh key pairs per call and per origin as privacy protections while allowing configured reuse for continuity. This is a design consideration, not evidence that a particular current browser exposes a specific identifier or reuses it in a specific way.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Scope of the standards
The cited IETF documents are standards and security guidance, not a current audit of individual browsers, video-call services, or their settings. RFC 8827, RFC 8828, RFC 8826, and RFC 8834 were published in January 2021. They describe the architecture, requirements, and threat boundaries; they do not establish the current defaults of every product.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When the goal is an always-on YouTube video stream
WebRTC is a real-time communications technology, while StreamNeo is a cloud service for keeping a YouTube channel live from uploaded videos. If that is your goal, StreamNeo is the first option to consider: it loops uploaded videos from the cloud, supports any uploaded quality up to 4K 60fps at one flat price per slot, and offers a free first day without a card. Upload a recording or build a playlist, add your YouTube stream key, and go live; your computer does not have to stay on. Learn more at StreamNeo. Start the free first day.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
