Private Internet Access, the VPN better known as PIA, includes a SOCKS5 proxy with its subscription. The server sits at proxy-nl.privateinternetaccess.com on port 1080, takes its own login, and exits in the Netherlands. For a PIA subscriber who wants one app on a Dutch address, it does the job at no extra cost. For work that needs a home address, or a country you choose, it is the wrong tool.
We read PIA's help center, order page and blog on October 22, 2026. We also resolved the proxy's name and looked up who holds its addresses. We did not buy PIA or send traffic through its proxy.
Looking for PIA S5 Proxy, the company that sells residential proxies? That is a separate business, and our PIA S5 Proxy page covers it.
What proxies does Private Internet Access offer?
PIA documents three, and each does a different job.
| SOCKS5 proxy | Shadowsocks | Browser extension proxy | |
|---|---|---|---|
| Where it works | Any app with a SOCKS5 setting, or Multi-Hop in the desktop app | Multi-Hop in the desktop app | Chrome or Firefox only |
| Encrypted | No | Yes | Yes, TLS 1.3 |
| Locations | The Netherlands | PIA's list, picked by the app or by you | 27 countries, with many US cities |
| Login | A separate SOCKS5 username and password | None beyond the PIA app | Your PIA account |
The SOCKS5 server is what most people mean by "PIA proxy". The desktop client sums it up in one line: "An unencrypted proxy that masks your IP address. Requires manual setup with a server IP and credentials."
The in-app route belongs to the desktop client. PIA's settings guides for iOS and Android list no Multi-Hop setting. A phone app with its own SOCKS5 setting can still take the server details below.
How do you set up the PIA SOCKS5 proxy?
Get the login. Sign in to the Client Control Panel, open Downloads, scroll to VPN Settings, then SOCKS, and choose Generate. This username and password differ from the "P" login that came with your subscription, and you can regenerate them later. That is also why people search for a "PIA SOCKS5 download": the login sits under Downloads, and the proxy itself needs no software.
In another app. Choose the type SOCKS5 and enter the host proxy-nl.privateinternetaccess.com, port 1080, and the generated login. An app that supports SOCKS5 without a username and password cannot use it, as PIA's own Tails guide points out.
As a proxy URL. Tools that take one line read the same details like this:
socks5h://USERNAME:PASSWORD@proxy-nl.privateinternetaccess.com:1080
The curl manual explains the two schemes. With socks5h, the proxy looks up each site's name, so those lookups leave from the Netherlands too. With socks5, your own machine does the lookup. PIA's Tails guide tests the proxy with curl and expects "an IP address in the Netherlands" in the answer.
Inside the PIA app. Open Settings, then Multi-Hop, tick Multi-Hop and Obfuscation, and choose SOCKS5 Proxy. Enter an IP address, port 1080 and the login. The app wants an address instead of the name, so PIA tells you to run nslookup on Windows, or host on macOS and Linux, and copy one result. PIA adds that these addresses change, so look the name up again if one stops working.
What do websites see through the PIA proxy?
That depends on the route you set up.
- Used directly in an app. The site sees one of the proxy's Dutch addresses.
- Used in Multi-Hop. PIA's help center draws the path as your device, then the proxy, then a PIA VPN server, then the internet. Sites see the VPN server's address. Your local network sees only the connection to the proxy. So Multi-Hop hides your VPN use from the network you sit on, and sites still see the VPN server you picked.
PIA contradicts itself here. Its blog post on SOCKS5, updated May 1, 2026, says the app sends data "first via a VPN server and then via a SOCKS5 proxy". The help center article, updated September 4, 2026, gives the reverse order, and Security.org's review of PIA agrees with the help center. We went with the newer and more specific page.
Is the PIA SOCKS5 proxy encrypted?
No, and PIA says so plainly. In its words, SOCKS5 "does not encrypt the connection to that proxy". The login gets no protection either. RFC 1929, the standard for SOCKS5 passwords, says the request "carries the password in cleartext".
That explains the separate proxy password, which keeps your account password off that hop. PIA's Tails guide even warns that the proxy password "will be exposed to the TOR exit node".
Inside Multi-Hop, PIA notes that the VPN tunnel still encrypts your traffic as a whole. Even so, its advice is blunt: "In most cases, Shadowsocks is the more convenient and suitable option."
Whose addresses does the PIA proxy use?
We resolved proxy-nl.privateinternetaccess.com from our server in the United States twice on October 22, 2026. Both times it returned 30 IPv4 addresses in the same two blocks. The name is an alias of proxy-nl.regions.cluster.piaservers.net, as PIA's Tails guide also shows. We then looked up each block in the RIPE registry and ran all 30 through our own IP lookup.
Every address belongs to NFOrce Internet Services and is announced by its network, AS43350, according to RIPEstat. PeeringDB lists NFOrce as a network service provider in seven data center facilities in Amsterdam, Rotterdam and Steenbergen.
One detail can mislead anyone who checks an address in whois. The smaller block is registered under the name Amsterdam_Residential_Television_and_Internet_Network. Its holder is still NFOrce, and our lookup flags those 11 addresses as datacenter. It did not flag the other 19. A registry name is a label in a record, and a lookup flag is one database's view. Each site judges an address with its own data.
For you, that adds up to one country and one network company. Every subscriber who sets up the proxy is pointed at the same name. Our guide to datacenter and residential proxies explains why sites treat the two kinds of address differently.
What does PIA cost?
The proxy has no price of its own, because it comes with the VPN. On October 22, 2026, during a Halloween offer, PIA's order page listed three plans.
Every plan renews on its own: monthly at $11.95, yearly at $47.88, or every three years at $79. New subscribers get a 30-day money-back guarantee. A Dedicated IP, a fixed VPN address that only you use, costs $5 a month extra and works inside the PIA app.
Where the PIA proxy helps, and where it stops
It helps a PIA subscriber who wants one program on a Dutch address while everything else stays on the home line. PIA's own blog names P2P file sharing and gaming as two of the most popular uses of SOCKS5. It also works the other way round: the VPN for the whole machine and one app on the proxy. The browser extensions add an encrypted proxy for Chrome or Firefox in 27 countries.
It stops at one country. The SOCKS5 server exits only in the Netherlands, so a job that needs a US or German address gets nothing from it. Every exit belongs to one network company, visible in the same registry records we read. Multi-Hop runs only in the desktop client, and the proxy login travels in cleartext.
Two of the guides that rank for this proxy go further. vpnAlert, an affiliate review site, calls it "often unavailable", which we could not check. vpnUniversity suggests it for web scraping, yet one Dutch name that every subscriber is pointed at suits that work badly.
When does a residential proxy fit better?
A residential proxy sends your traffic through addresses that internet providers assign to homes, in a country you pick. That matters wherever a site judges the address: prices and search results by country, ad checks, or anything where a data center address gets treated differently.
Our residential proxies speak SOCKS5 and HTTP, with no subscription. One GB of Residential Lite costs $0.50/GB, falling to $0.44/GB at 2,000 GB+, with country targeting. Premium costs $1.49/GB for one GB and $1.00/GB at 1,000 GB+. It adds state, city, network (ASN) and device targeting, sticky sessions from 3 minutes to 24 hours, and UDP over SOCKS5. Our GB have no scheduled expiry date, and we refund unused balance within 14 days.
If you would buy PIA only for its proxy, one month costs $11.95 for one Dutch exit. About the same money, $11.50, buys 23 GB of Lite in a country you choose. If you want one fixed address for a month instead, our ISP proxies cost $2.70/IP.
Whether to rotate addresses or hold one is its own choice, covered in rotating vs static residential proxies. What a SOCKS5 proxy is explains the protocol itself. Our free proxy list and proxy checker cost nothing, so you can try a tool's proxy settings before you pay anyone.
The verdict
Our rating: 3 out of 5, judged as a feature that comes with a VPN.
PIA's proxy puts one app on a Dutch address at no extra cost, and setup takes a generated login and four values. Against it: one country, one network company, a password sent in cleartext, and a blog that contradicts the help center on how Multi-Hop routes traffic.
- Who it suits. PIA subscribers who want one app on a separate address.
- Who should skip it. Anyone who needs a home address, a country other than the Netherlands, or many addresses.
Limits of this review
- We did not buy PIA, log in, or send traffic through its proxies. Nothing here measures speed, stability or blocks, on any network, ours included.
- The 30 addresses come from one DNS answer, read twice from one server on one day, and PIA says they change.
- Our lookup's datacenter flag is one database's view of an address.
- vpnAlert's outage reports, and its claim that only OpenVPN works with the proxy, could not be checked against PIA's pages.
- The prices are a Halloween offer. We will check this page again by December 22, 2026.
Sources
- Private Internet Access help center, read October 22, 2026: "How to Generate Proxy Credentials" (updated September 23, 2026), "Understanding the Multi-Hop Feature" (September 4, 2026), "Using a VPN/Proxy in Tails" (August 4, 2026), "How Do Your Browser Extensions Work?" (September 23, 2026), "Understanding Basic Settings on the PIA Client" (August 3, 2026) and "What Subscriptions Are Available With PIA?" (October 21, 2026).
- Private Internet Access, order page and Dedicated IP page, read October 22, 2026.
- Private Internet Access blog, "Is A SOCKS5 Proxy Better Than a VPN?", updated May 1, 2026.
- RIPE NCC registry records and RIPEstat for both blocks, and PeeringDB for AS43350, read October 22, 2026.
- IETF, RFC 1929, "Username/Password Authentication for SOCKS V5", March 1996.
- curl project, curl manual, options --socks5 and --socks5-hostname, read October 22, 2026.
- Security.org, review of Private Internet Access, updated December 5, 2025. vpnAlert, guide to the PIA SOCKS5 proxy, updated August 1, 2026. vpnUniversity, PIA SOCKS proxy tutorial, modified December 1, 2021.
- HProxy, DNS reading and IP lookup of the 30 addresses, and our catalog, October 22, 2026.
