"HTTPS proxy" names how you reach the proxy. Both kinds carry the same sites. Chromium's documentation says so plainly: "HTTP proxies can proxy http:// , https:// , ws:// and wss:// URLs." An HTTPS proxy "works like an HTTP proxy, except the communication to the proxy server is protected by TLS". urllib3, the library under Python requests, sums it up. "The only difference between them is if you need to establish a TLS connection to the proxy first."
We read Chromium's proxy documentation, RFC 9110, curl's manual and changelog, urllib3's documentation, MDN and five other guides on October 13, 2026, all from our server.
What is the difference between an HTTP and an HTTPS proxy?
You speak to an HTTP proxy in cleartext: your requests and proxy commands travel to it unencrypted. You reach an HTTPS proxy over TLS: your client opens an encrypted connection to the proxy first, then sends everything inside that channel. The label describes the first hop, between you and the proxy. Both kinds forward http:// and https:// sites.
Only HTTP proxy
- Reached in cleartext
- Requests and proxy commands travel unencrypted to it
Both
- Carry https:// sites
- Add no encryption past the proxy
Only HTTPS proxy
- Reached over TLS
- Everything to it travels inside that channel
Why an HTTP proxy already handles HTTPS sites
For an https:// address, your client sends the proxy a CONNECT request. RFC 9110 defines it as a request to "establish a tunnel to the destination origin server identified by the request target". After that, the proxy restricts itself "to blind forwarding of data, in both directions, until the tunnel is closed". Your browser then completes its TLS handshake straight through to the website. Chromium describes the same path: "When proxying https:// requests through an HTTP proxy, the TLS exchange is forwarded through the proxy using the CONNECT method".
So a plain HTTP proxy passes the site's encryption through untouched. The proxy learns the destination hostname, since it has to open the tunnel, and the contents stay encrypted. That is why the industry needed a separate word for a proxy you reach over TLS.
Your client
sends CONNECT host:443
HTTP proxy
opens a blind tunnel
HTTPS site
TLS ends here, not at the proxy
The four cases
Two choices make four cases: an HTTP or HTTPS proxy, and an http:// or https:// site. urllib3's documentation describes each. With an HTTP proxy and an https:// site, "A TCP tunnel will be established with a HTTP CONNECT". With an HTTPS proxy and an https:// site, "A TLS-in-TLS tunnel will be established."
Proxy and site: what each hop can read
| Proxy and site | The network sees | The proxy sees |
|---|---|---|
| HTTP, http:// site | Everything | Everything |
| HTTP, https:// site | The hostname | The hostname |
| HTTPS, http:// site | Only the proxy | Everything |
| HTTPS, https:// site | Only the proxy | The hostname |
urllib3's documentation on HTTP and HTTPS proxies and Chromium's proxy documentation, read October 13, 2026
The third row is the one people miss. An HTTPS proxy in front of an http:// site protects the hop to the proxy, and the proxy then sends the request on as plain HTTP.
What an HTTPS proxy adds
Encrypting the first hop protects what a plain HTTP proxy leaves readable on it. With a cleartext HTTP proxy, anyone on the network between you and the proxy can read your proxy username and password. That network might be a shared office or café, or a compromised router. It can also read the CONNECT lines that name the sites you visit. Chromium's documentation: "since CONNECT requests are sent over a protected channel, the hostnames for proxied https:// URLs" are protected too. An HTTPS proxy can also check a client certificate, and it "may negotiate HTTP/2 (but not QUIC)".
That last point matters for speed in Chrome. "HTTP/1.1 proxies in Chrome are limited to 32 simultaneous connections across all domains", while an HTTPS proxy speaking HTTP/2 can carry more at once.
curl's maintainer described the feature when it arrived. "HTTPS proxy means that the client establishes a TLS connection to the proxy and then communicates over that". The same post adds: "Talking HTTPS to your proxy is a privacy improvement as it prevents people from snooping on your proxy communication." curl's changelog dates it: "Fixed in 7.52.0 - December 21 2016", with the line "proxy: Support HTTPS proxy and SOCKS+HTTP(s)". In the current manual, an https:// prefix selects it, and a proxy given without a scheme, or with http://, "is treated as an HTTP proxy".
What an HTTPS proxy protects
The first hop
the you-to-proxy leg, over TLS
Your proxy credentials
hidden from anyone on your local network
The hostnames you request
the CONNECT lines are encrypted too
What no proxy protects
The proxy-to-site leg
only the site's own HTTPS covers it
A plain HTTP destination
in the clear whatever the proxy
Your data end to end
that is the site's TLS, not the proxy
Using an HTTPS proxy in a browser
The usual settings screens rarely take one. Chromium's documentation: "Specifying an HTTPS proxy is generally not possible through system proxy settings." Chrome instead reads it from a PAC script, the command line, an extension or a policy. In a PAC script the entry is the value MDN lists as "HTTPS host:port", "The specified HTTPS proxy should be used". The same Chromium page states that "Chrome, Firefox, and Opera support HTTPS proxies; however, most older HTTP stacks do not." We tested no browser for this page.
Where the anonymity grades come in
A plain HTTP proxy can read and add headers on requests it forwards in the clear, which is where the transparent, anonymous and elite grades come from. A transparent proxy passes your address on in X-Forwarded-For; an elite one adds nothing. The grade describes what the proxy does to the request, so reaching it over TLS changes who can watch the first hop and leaves the grade as it was.
What other guides get wrong
- Geonode writes that an HTTPS proxy "uses the HTTPS protocol to secure the data being transmitted between your device and the destination server", and "Unlike HTTP proxies, HTTPS proxies encrypt your data". The encryption to an https:// site comes from the site's own TLS, through either kind of proxy.
- Swiftproxy writes "With an HTTP proxy, your data is not encrypted", and with HTTPS "all your data is encrypted end-to-end". An https:// site stays encrypted through an HTTP proxy, and an http:// site stays readable between an HTTPS proxy and the site.
- Crawlbase says the two kinds "describe how much of your traffic the proxy can read". The proxy reads the same either way; the network between you and the proxy is what reads less.
- Byteful has it right: an "HTTPS proxy" refers "specifically to the TLS encryption of the direct connection between the source and the proxy". It also mentions a meaning about bypassing restrictions without a source.
- SOAX explains an HTTP proxy without CONNECT, so a reader cannot tell that it already carries https:// sites.
Where HProxy fits
Every HProxy product speaks HTTP and HTTPS and carries https:// sites through CONNECT like any HTTP proxy; SOCKS5 is on both residential pools, ISP, IPv4 and mobile. If you need the first hop itself encrypted, ask our support whether your plan's gateway accepts a TLS connection before you rely on it. Whichever you use, the exit address decides how a site treats your requests. Residential proxies cost $0.50 per GB for one GB, and datacenter addresses cost $1.58 per IP a month. Our HTTP vs SOCKS5 page compares the other protocol, and the proxy checker tests an address before you rely on it.
What we could not find out
- Which proxy sellers accept TLS connections to their proxies. Few say.
- Whether our own gateway does. Nothing we publish says so, which is why the section above points to support.
- How Firefox and Opera configure an HTTPS proxy in practice. We read Chromium's statement and MDN's PAC value, and tested no browser.
Our next check of these documents is due by April 13, 2027.
Sources
Every page below was read on October 13, 2026, from our server.
- Chromium: Proxy support in Chrome (net/docs/proxy.md).
- IETF: RFC 9110, HTTP Semantics, CONNECT (June 2022).
- MDN: CONNECT request method and Proxy Auto-Configuration (PAC) file.
- urllib3: Advanced usage, HTTP and HTTPS proxies (version 2.8.0).
- curl: the manual, --proxy and changes in 7.52.0 (December 21, 2016).
- curl's maintainer: "HTTPS proxy with curl" (November 26, 2016).
- Google Keyword Planner: worldwide monthly averages, pulled October 13, 2026.
- Guides we judged, read the same day and deliberately left unlinked: Geonode, Swiftproxy, Crawlbase, Byteful and SOAX.
