PAC file
A proxy auto-config file: one JavaScript function that decides, per request, whether traffic goes direct or through which proxy.
A PAC file is a single JavaScript function with a routing job. The browser calls FindProxyForURL with each request's URL and hostname, and the function returns marching orders as a string: DIRECT to go straight out, or PROXY host and port, or SOCKS5 host and port, to route through an intermediary. Return a semicolon-separated list and the browser treats it as fallbacks, trying each in turn if the previous one is unreachable.
The format exists because one proxy for everything is usually wrong. The classic corporate need is split routing: internal applications reached directly, general web traffic through the filtering proxy, some destination categories through a different egress entirely. A configuration that is code can express all of that, and the standard helper functions are built for exactly these tests: matching the hostname against patterns, checking whether an address falls inside a network range, distinguishing plain hostnames from qualified ones.
Delivery is the loosely attached half. A machine can be pointed at a PAC URL explicitly in its proxy settings, or discover one automatically through WPAD; either way the browser fetches the file and evaluates the function per request from then on. The pairing is worth keeping straight: discovery is how the file is FOUND, and the PAC format is what the file IS. You can use the format without the discovery, and locking the URL down explicitly is precisely how you get central routing without the discovery protocol's trust problems.
Anyone who has maintained one learns the same lessons. Failures are silent: a script error or an unreachable PAC URL typically degrades to everything going direct, which LOOKS like working internet while quietly bypassing the proxy, an unpleasant surprise when the proxy was doing security work. The function runs on every request, so an expensive test, particularly anything that triggers a DNS lookup per call, taxes all browsing. And browsers cache both the file and decisions, so a stale PAC can outlive its correction until caches clear.
For individual proxy users the format is mostly encountered secondhand, on managed machines, but it has one genuinely useful solo application: sending ONLY chosen destinations through a proxy. A short PAC that returns a proxy for the handful of hostnames you are testing and DIRECT for everything else gives per-site routing in any browser, no extension required, which is exactly the split a full-machine setting cannot express.
Frequently asked questions
What does a PAC file contain?
One JavaScript function, FindProxyForURL, receiving each request's URL and host and returning a routing instruction: DIRECT, or PROXY with a host and port, or SOCKS5 likewise, optionally as a fallback list. Standard helpers support the usual tests, hostname patterns and address-range membership, so the function is typically a short cascade of rules ending in a default.
How is a PAC file different from WPAD?
The PAC file is the configuration; WPAD is one way of finding it. A machine can be given the PAC URL explicitly, which is the controlled arrangement, or can discover one automatically from the network, which is where the trust problems live. Format and discovery are separable, and security guidance is usually: keep the format, pin the URL, disable the discovery.
Why is my PAC file being ignored?
The common causes are quiet ones. A syntax error or an unreachable PAC URL makes browsers fall back to direct connections without visible complaint. Caching keeps an old version live after you fixed the file. And some applications simply do not honour system PAC settings, using their own proxy configuration instead. Testing with a URL the function routes distinctively identifies which failure you have.
Can I use a PAC file to proxy only certain websites?
Yes, and it is the neatest tool for exactly that. A function that returns your proxy for a listed set of hostnames and DIRECT for everything else routes only the chosen sites through the exit, in any browser, with no extension. It is the same split-routing idea corporations use, pointed at a personal need: testing a handful of destinations through a proxy while normal browsing stays untouched.
Back to the full glossary.