HideMyAss Free Proxy Review: The Anonymity Myth

The name is a promise. "Hide My Ass" tells you exactly one thing: use it, and nobody can see who you are. It is a great name, and it is the reason the HideMyAss free proxy is worth a careful read, because the most famous story about the service is the time it helped send one of its own users to prison.

Is the HideMyAss free proxy anonymous?

No. The HideMyAss free web proxy hides your IP address from the websites you open, but not from HMA itself. By its own privacy policy the proxy records your real IP address, the domains you request, and the timestamps of those requests. It is a separate service from HMA's audited no-logs VPN, and those records can be handed to authorities.

What HideMyAss actually is

A teenager named Jack Cator built HideMyAss in 2005, in Norfolk, England, when he was sixteen. The first version was a free web proxy: you typed a URL into a box on his site, the site fetched that page for you, and the destination only ever saw the proxy's address instead of yours. It spread on forums, hit the front page of Digg, and grew from there.

Twenty years later the brand is mostly a paid VPN. HMA was bought by AVG Technologies in 2015, folded into Avast when Avast acquired AVG in 2016, and now sits inside Gen Digital, the company formed when Avast merged with NortonLifeLock. The free web proxy and the browser extensions still exist, and they still carry the original promise in the name. What changed is who owns the logs. The fact that there are logs at all is the whole story.

The 2011 case that settled the question

In 2011 a group called LulzSec ran a string of high-profile hacks, including a breach of Sony Pictures. One member, Cody Kretsinger, who went by "recursion," used HideMyAss to cover his tracks.

It did not work. HMA had recorded the connection metadata tied to his account: the IP address his traffic came from, and the times he connected and disconnected. According to reporting from the period, HMA said it complied with a UK court order and provided that information, which helped investigators tie the account back to a real person. Kretsinger pleaded guilty in 2012 and was sentenced to a year and a day in prison, followed by home detention, roughly a thousand hours of community service, and restitution of more than 600,000 dollars.

Two honest caveats belong here. First, the mechanism: reporting from the time says a UK court order compelled the logs, issued at the request of US investigators, and HMA's own public position was that it cooperated only under that court order. Second, and this is the part most write-ups skip: Kretsinger was using HMA's paid VPN, not the free web proxy.

That second point is exactly why the case belongs in a piece about the free proxy. A service sold on the idea of anonymity kept enough records to pin down a specific individual, and when authorities came asking, the company produced them. HMA even noted, accurately, that it never logged the contents of anyone's traffic. It did not need to. The IP address and the timestamps were plenty.

The nuance almost everyone gets wrong

After the backlash, HMA cleaned up its VPN. In 2020 it introduced a no-logs policy for the VPN apps and had it checked by an outside firm, VerSprite. That is a real, verifiable improvement for the paid product, and it deserves credit.

Here is the catch. That no-logs policy covers the VPN. The free web proxy and the browser extensions are a separate service, and by HMA's own privacy terms they still log the originating IP address, the domain names you visit, and the timestamps of your requests. So the exact tool that carries the "Hide My Ass" name for free is the one that keeps the category of record that identified a LulzSec member. The reform people remember does not apply to the product most of them are actually using.

Why a web proxy cannot make you anonymous

This is not unique to HMA, and it is worth understanding once. A web proxy sits in the middle, between you and a website. It hides your IP address from the destination, which is real and occasionally useful. It hides nothing from the operator of the proxy, because the operator is the middle. It sees your real IP, every domain you ask for, and exactly when you asked. On a plain HTTP page it can see even more, and it can change what comes back to your browser.

So "anonymous" through any free web proxy only ever means anonymous to the website, and fully visible to whoever runs the proxy. The single question that matters is what that operator writes down and who they will give it to. HMA answered both questions in public a long time ago, and the answer for the free proxy has not changed.

So when is a free proxy actually fine?

Plenty of the time, honestly. If you want to open a geo-blocked article, see how a page renders from another country, or run some low-stakes scraping, a free proxy is a sensible tool and the logging simply does not matter for what you are doing. We wrote a longer piece on when free proxies are fine, and a full teardown of a popular browser-based option in our CroxyProxy review.

What a free web proxy is not is a shield for anything you would not want tied to your real IP address. For that you need either a no-logs tool you have real reason to trust, or infrastructure you control. If your use case needs a genuine residential exit rather than a shared web proxy, our guide to free residential proxies lays out what is realistic and what is just marketing.

Check it, do not trust it

The useful habit is to stop taking any proxy at its word. Run it through our proxy checker and you can see for yourself what it exposes: the IP the world sees, whether it quietly leaks your real one, and whether the connection is what the homepage claims. A slogan on a landing page is a slogan. What the tool actually reveals about you is the only thing that counts.

If you want free proxies without the guessing, our free proxy list is tested continuously and shows you what each one really does before you send a single request through it.