Before WebRTC, putting a phone call in a web page meant a plugin or a downloaded softphone. The W3C WebRTC 1.0 recommendation and the IETF RTCWEB documents (including RFC 8825 for architecture and RFC 8829 for JavaScript Session Establishment Protocol, JSEP) standardized the pieces: media capture, peer connection, ICE, and mandatory encryption. Chrome, Firefox, Safari, and Edge ship the stack. Native mobile SDKs expose the same protocols.
WebRTC is not a complete telephone system. It does not assign E.164 numbers, bill minutes, or define how a call is routed to an agent. Applications supply signaling (often via CPaaS) and, when a PSTN number is involved, a gateway to SIP and the PSTN.
The browser real-time stack
Three APIs cover most voice use:
- getUserMedia
- Requests microphone (and camera) access and returns a MediaStream. The user must grant permission.
- RTCPeerConnection
- Owns ICE, DTLS, SRTP, and the SDP offer/answer. This object represents the call itself.
- RTCDataChannel
- SCTP over DTLS for application data such as chat or signaling fallback. DTMF is sent separately, via insertDTMF on an audio sender.
JSEP keeps SDP in the application: createOffer / createAnswer, setLocalDescription, setRemoteDescription. The application carries those descriptions over its own signaling channel. That is why WebRTC can sit behind any signaling protocol, including SIP if a gateway translates.
ICE, STUN, and TURN
Browsers are behind NATs. Interactive Connectivity Establishment (ICE, RFC 8445) gathers candidate addresses, checks connectivity in pairs, and selects a working path. Candidates come from:
- Host: the local interface (often a private RFC 1918 address).
- Server reflexive: the public mapping discovered via STUN (Session Traversal Utilities for NAT, RFC 8489).
- Relayed: a TURN allocation (Traversal Using Relays around NAT, RFC 8656) when direct or STUN-assisted paths fail.
A successful call may still use TURN for the entire session on restrictive corporate firewalls (symmetric NAT, UDP blocked). TURN is a media relay, so it adds latency and operating cost. STUN is only a discovery protocol. It does not relay audio. Deployments that skip TURN will fail for a fraction of users; that fraction is often the office network you care about most.
Encrypting media: DTLS-SRTP
Browser WebRTC requires DTLS-SRTP (RFC 5764). DTLS (Datagram TLS) performs a handshake over the same ICE-selected 5-tuple that will carry media. The keys derived from that handshake protect SRTP. There is no 'plain RTP' mode in a normal browser. The DTLS certificate is tied to the session by a fingerprint carried in SDP, so a man in the middle on the media path cannot complete the handshake without also tampering with signaling.
This is stricter than many SIP trunks, which still carry unencrypted RTP between SBCs on private interconnects. When a WebRTC client talks to a SIP phone, the gateway terminates DTLS-SRTP on one side and may use RTP or SRTP on the other.
WebRTC versus SIP
| WebRTC | SIP | |
|---|---|---|
| Client environment | Browser or app with a WebRTC stack | Dedicated user agent (phone, PBX, SBC) |
| Signaling | Application-defined; JSEP SDP blobs | RFC 3261 methods and headers |
| NAT | ICE required | Optional ICE; often an SBC instead |
| Encryption | DTLS-SRTP mandatory in browsers | SRTP optional; many trunks unencrypted internally |
| Default audio | Opus (plus G.711 for interoperability) | G.711 ubiquitous; G.722 / Opus if configured |
| DTMF | RTCRtpSender.insertDTMF (RFC 4733 events) | RFC 4733, in-band, or SIP INFO |
| Telephone numbers | Via a gateway / CPaaS | Native DIDs on SIP trunks |
Typical uses
Click-to-call on a website: the visitor grants microphone access, the app creates a peer connection to a media server, and the server places a SIP call to an agent or an IVR. In-app calling keeps the conversation on the data path instead of handing it to the mobile dialer, which helps when you need recording, application context, or HD Opus audio between apps.
WebRTC also carries video and data channels, but the voice-specific constraints are the same as any VoIP path: capture latency, 20 ms packetization, and the G.114 delay budget. See call quality. Opus makes wideband and fullband the default between two browsers. The moment the call hits G.711 toward the PSTN, that advantage ends.
Operational limits
Browsers can suspend tabs, revoke mic permission, and change ICE state when a laptop sleeps. Autoplay policies block remote audio until a user gesture in some cases. Background tabs on mobile may not keep a peer connection alive. These are product constraints, not codec bugs.