What Is a SOCKS5 Proxy? A Plain-English Guide With the Details Kept In

A SOCKS5 proxy is a relay that forwards your app's connections without reading what flows through them. It carries any TCP traffic, can look up the address for you, accepts a login and, in theory, relays UDP. It encrypts nothing. We tested what that means in practice on October 22, 2026. Five common clients talked to our own SOCKS5 test server, and 400 free SOCKS5 proxies went through a UDP check. One of the 293 that answered relayed UDP.

What is a SOCKS5 proxy?

SOCKS5 is version 5 of the SOCKS protocol, defined in RFC 1928 in 1996. The RFC calls it a framework for applications "in both the TCP and UDP domains" to pass through a firewall. A SOCKS5 proxy asks only one question: which host and port should it connect you to? Whatever flows afterwards is opaque to it: web pages, game packets or a database protocol.

An HTTP proxy works one layer up. It parses your request, can read and rewrite headers, cache answers and refuse URLs. That difference explains most of what SOCKS5 is good and bad at.

How does a SOCKS5 connection work?

The protocol is short. A connection through a SOCKS5 proxy takes four steps:

1. Greeting. Your client connects to the proxy and sends the version byte, 5, followed by the login methods it supports.
2. Method choice. The proxy picks one: "no authentication" on open proxies, or username and password from RFC 1929 on paid ones. If nothing fits, it answers 0xFF and closes.
3. Request. The client sends a command and a destination. CONNECT opens a TCP connection and covers nearly all use. BIND accepts an incoming connection, and UDP ASSOCIATE sets up a UDP relay.
4. Relay. The proxy reports success and from then on copies bytes in both directions.

Two details of step 3 matter more than the rest of the spec: who resolves the address, and whether UDP really works.

Who resolves the address, you or the proxy?

Each SOCKS5 request carries an address type: an IPv4 address, an IPv6 address, or a domain name. A name travels as one length byte and the name, with "no terminating NUL octet". If the client sends the name, the proxy does the DNS lookup. If it sends an address, your own machine already asked your local resolver, and that lookup never went through the proxy.

In curl and Python, the scheme decides. socks5:// resolves the name on your machine, while socks5h:// hands the name to the proxy. We pointed five clients at a SOCKS5 test server on one Windows 11 PC and logged what each one sent:

With socks5://, curl and requests both sent the IPv6 address of example.com. With socks5h://, both sent the name. Chrome's own documentation says it "will always use proxy side resolution". If you use a proxy for privacy and resolve names locally, your DNS lookups still leave from your own connection.

Can a SOCKS5 proxy use a login?

Yes, through RFC 1929, and paid proxies usually ask for one or for an IP allowlist. The login travels unencrypted. RFC 1929 says so itself: the request "carries the password in cleartext". It advises against the method wherever "sniffing" is possible. The login guards access to the proxy and protects none of your data.

Browsers are the weak spot. Chromium's documentation states: "No authentication methods are supported for SOCKSv5 in Chrome". In our test, Chrome 155 offered only "no authentication", and our login-only server turned it away. curl, Python requests and PowerShell all sent the login when we gave them one.

Does SOCKS5 support UDP?

On paper, yes. "The UDP ASSOCIATE request is used to establish an association within the UDP relay process to handle UDP datagrams." In practice, support is rare. On October 22, 2026, we drew 400 random proxies from the SOCKS5 section of our free list and ran them through our UDP check. 293 answered as SOCKS5 proxies. One of them relayed UDP.

Chrome cannot use it at all: Chromium notes that SOCKS5 in Chrome "cannot be used to relay UDP traffic". In a test of paid SOCKS5 endpoints published on October 2, 2026, AIMultiple reports UDP failures at several large providers. If your job needs UDP, test the exact proxy with our UDP proxy checker before you rely on it.

Does a SOCKS5 proxy encrypt your traffic?

No. SOCKS5 has no encryption at all. HTTPS through it stays encrypted because of TLS, end to end between your client and the site. Plain HTTP, mail or any other unencrypted protocol stays readable to the proxy operator.

TLS only protects you if your client checks certificates. Our checker fetches an HTTPS page through each working free proxy and looks at the certificate that comes back. On October 22, 2026, 179 of 2,291 working free SOCKS5 proxies with an answer returned a certificate that public roots reject. That is 7.8%. A browser refuses such a certificate. A script with certificate checks switched off accepts it, and the proxy reads everything.

How is SOCKS5 different from an HTTP proxy?

SOCKS5 has no headers to leak. A proxy list grades HTTP proxies as transparent, anonymous or elite. The grades describe what an HTTP proxy adds to forwarded requests. A transparent one passes your IP in X-Forwarded-For. A SOCKS5 proxy never touches that layer, so it cannot leak your IP that way.

Neither encrypts anything. People who call SOCKS5 more secure usually mean that it does not modify traffic. Security comes from TLS in both cases.

HTTP proxies win when you want the meddling. Caching, filtering and rewriting requests need a proxy that understands HTTP.

For the full comparison, see HTTP vs SOCKS5 proxy. For what changed from the older version, see SOCKS4 vs SOCKS5.

What is the SOCKS5 default port?

RFC 1928 says "the SOCKS service is conventionally located on TCP port 1080". Convention is all it is. Of 2,432 working free SOCKS5 proxies on our list on October 22, 2026, only 116 used port 1080. Port 4145 was more common, with 131, and 2,140 sat on ports outside the five most common ones.

Always take the port from your provider or the list. A client that assumes 1080 will miss most proxies.

When is SOCKS5 the right choice?

• Traffic that is not plain web browsing. Mail clients, IRC, SSH hops, database connections and custom protocols. An HTTP proxy can tunnel some of these with CONNECT, but many allow CONNECT to port 443 only.
• Apps with SOCKS5 built in. Torrent clients, messaging apps, game launchers and most scraping frameworks speak it natively.
• Privacy with remote DNS. With socks5h or a client that sends names, your DNS lookups leave from the proxy.
• One proxy for a whole app. Point an application at one SOCKS5 endpoint and every protocol it uses follows.

Pick HTTP when your tool only accepts HTTP proxies, or when caching and header control help your pipeline.

Is a SOCKS5 proxy a residential proxy?

Not by itself. SOCKS5 is the protocol your app speaks to the proxy. Residential or datacenter describes the address the website sees, which the network behind it decides. The free SOCKS5 proxies on our list are mostly server addresses: on October 22, 2026, 2,111 of 2,432 were on hosting networks. One hosting network, M247, carried 1,933 of them.

Paid proxies often offer both protocols, though not always on every plan. Among our residential proxies, both pools come as HTTP or SOCKS5 lines. Residential Lite, the cheaper pool, costs $0.50 for one GB, with country targeting. Residential Premium costs $1.49 per GB, falling to $1.00 per GB at 1,000 GB+, and can also open UDP relays on SOCKS5. Our IPv4 datacenter proxies speak HTTP, HTTPS and SOCKS5; the IPv6 addresses we sell per IP speak HTTP and HTTPS.

How do you use a SOCKS5 proxy?

curl is the fastest way to try one. Take a live SOCKS5 proxy from our free API and send a request through it:

# One live SOCKS5 proxy, fresh from the pool
curl "https://hproxy.com/api/proxy-list?format=txt&protocol=socks5&recent=true&limit=1"

# Send a request through it, with DNS resolved at the proxy (socks5h)
curl -x socks5h://IP:PORT -s https://httpbin.org/ip

If the second command prints the proxy's IP instead of yours, the relay works. Our SOCKS5 section of the free list shows live entries with uptime and network data. Our proxy checker grades any proxy you paste, including whether it really speaks SOCKS5.

For anything beyond tests, the free-pool rules apply, as our guide to when free proxies are fine explains. Free SOCKS5 proxies are shared, slow and short-lived: the median working one took 5.4 seconds to answer our checker.

What do people get wrong about SOCKS5?

• "SOCKS5 hides me from websites." It hides your IP. Browser fingerprints, cookies, WebRTC and your logged-in accounts stay as they were.
• "SOCKS5 is encrypted." No part of the protocol encrypts anything. TLS does, when your client uses it and checks certificates.
• "SOCKS5 is always faster." It skips header parsing, but the server's load and distance decide the speed. Measure it.
• "The login makes it secure." RFC 1929 sends the password in cleartext. It gates access to the proxy only.
• "UDP support means it is great for gaming." One of 293 working free SOCKS5 proxies relayed UDP in our check. Test the exact server first.

What this page could not check

• One PC, five clients. The client test ran on one Windows 11 PC on October 22, 2026, against our own test server. Other versions and settings behave differently.
• Free proxies only. The port, UDP and certificate counts cover public free proxies our checker collects. Paid proxies were not tested, ours included.
• A single UDP sample. The UDP check covered 400 random proxies from one moment. 107 of them did not answer at all.
• Firefox logins. We did not test whether Firefox can log in to a SOCKS5 proxy.
• Check by January 22, 2027. Browser behavior and free-list numbers change.

Sources

• RFC 1928: SOCKS Protocol Version 5. IETF, March 1996.
• RFC 1929: Username/Password Authentication for SOCKS V5. IETF, March 1996.
• Proxy support in Chrome (net/docs/proxy.md). Chromium source, read October 22, 2026.
• We Tested the Best SOCKS5 Proxies. AIMultiple, updated October 2, 2026, read October 22, 2026.
• HProxy SOCKS5 client test: five clients on one Windows 11 PC against a local SOCKS5 test server, October 22, 2026.
• HProxy free proxy list: working proxies by protocol and port, and the certificate check, October 22, 2026, 09:02 UTC.
• HProxy free checker: UDP check of 400 random free SOCKS5 proxies, October 22, 2026.