What Is a SOCKS5 Proxy and How Is It Different from HTTP?

How SOCKS5 works under the hood

SOCKS5 is defined in RFC 1928 (1996). It sits between the transport layer and the application: the proxy does not parse HTTP, TLS or any other protocol, it simply opens a connection on your behalf and copies bytes in both directions. That is why one SOCKS5 proxy can carry browser traffic, a Telegram session, a game client or an SMTP connection with no special support for any of them.

The handshake, step by step

1. 1Greeting. The client connects to the proxy port and sends the version byte 0x05 plus a list of authentication methods it supports.
2. 2Method selection. The server picks one: 0x00 no authentication, 0x01 GSSAPI, 0x02 username/password, or 0xFF if none of the offered methods is acceptable.
3. 3Authentication. With username/password, the client sends credentials using the subnegotiation from RFC 1929, and the server answers success or failure.
4. 4Request. The client sends a command and a destination. The address can be an IPv4 address, an IPv6 address or a domain name.
5. 5Reply and relay. The server reports whether it reached the target, then simply relays data until either side closes the connection.

The three commands

• CONNECT opens an outgoing TCP connection. This is what browsers, scrapers and messengers use 99% of the time.
• BIND asks the proxy to accept an incoming connection. It was designed for protocols like active-mode FTP and is rarely used today.
• UDP ASSOCIATE sets up a UDP relay, which matters for DNS, some games, VoIP and QUIC. Not every SOCKS5 server enables it, so confirm UDP support before you rely on it.

How HTTP proxies work: forwarding vs CONNECT

An HTTP proxy is an HTTP server that accepts requests meant for other servers. It operates in two very different modes depending on whether the target site uses plain HTTP or HTTPS.

Plain HTTP forwarding

For an http:// URL the client sends the full address in the request line, for example GET http://example.com/page HTTP/1.1. The proxy reads the request, can add or strip headers, can cache the response and then fetches the page itself. Because the proxy sees everything, a misconfigured or careless proxy may add headers such as Via or X-Forwarded-For that reveal proxy use or even your real IP.

CONNECT tunneling for HTTPS

For https:// URLs the client sends CONNECT example.com:443 HTTP/1.1. The proxy opens a TCP connection to that host, replies 200 Connection established and from that moment just copies bytes. The TLS session runs end to end between your client and the website, so the proxy sees the hostname but not the URLs, cookies or page content. Functionally, an HTTP proxy in CONNECT mode behaves a lot like SOCKS5 CONNECT, which is why both work fine for modern HTTPS-only sites.

Authentication uses the Proxy-Authorization header, usually with the Basic scheme. If credentials are missing or wrong, the proxy answers 407 Proxy Authentication Required. Basic auth is only base64-encoded, not encrypted.

SOCKS4, SOCKS4a and SOCKS5 compared

You will still see SOCKS4 in app settings, so it helps to know what the older versions lack.

• SOCKS4 supports only TCP and only IPv4 destinations. There is no real authentication, just an optional user ID field. The client must resolve DNS itself.
• SOCKS4a adds one thing: the client can pass a domain name, and the proxy resolves it. Still IPv4 and TCP only.
• SOCKS5 adds proper authentication methods, IPv6 destinations, domain names, UDP relay and the BIND command in a cleaner form.

If a provider gives you SOCKS5 credentials, always pick SOCKS5 in your app. Selecting SOCKS4 with a login and password will simply fail, and an IPv6-only proxy cannot work over SOCKS4 at all.

Remote DNS and the socks5h:// scheme

With SOCKS5 the client can send either an IP address or a hostname. If your app resolves the hostname locally first, the DNS query goes through your own ISP resolver, outside the proxy. That is a classic DNS leak: the site sees the proxy IP, but your provider (and any DNS-based geolocation) sees which domains you visit, and the answer you get may be tuned for your real location rather than the proxy location.

In many tools the scheme name controls this. socks5:// usually means the client resolves names locally, while socks5h:// means the hostname is passed to the proxy, which resolves it on its side. Firefox exposes the same choice as the checkbox Proxy DNS when using SOCKS v5. With HTTP proxies the question does not arise in the same way: the hostname is always sent to the proxy, either in the request line or in CONNECT.

# DNS resolved on your machine
curl -x socks5://user:[email protected]:1080 https://example.com

# DNS resolved by the proxy (recommended)
curl -x socks5h://user:[email protected]:1080 https://example.com

Does SOCKS5 encrypt traffic? The short answer is no

A common myth says SOCKS5 is "more secure" because it is a lower-level protocol. Neither SOCKS5 nor an HTTP proxy encrypts anything by itself. Encryption comes from the application protocol inside the tunnel:

• HTTPS sites are protected by TLS end to end, whether you use SOCKS5 or HTTP CONNECT. The proxy cannot read page content in either case.
• Plain HTTP, FTP or unencrypted game traffic is visible to the proxy and to anyone on the network path, regardless of proxy type.
• Proxy credentials are exposed in both protocols unless the link to the proxy is itself wrapped in TLS or a VPN.

SOCKS5 vs HTTP proxy: side-by-side comparison

Which apps support SOCKS5, HTTP or both

Browsers

Chrome, Edge and Firefox accept both protocols, but their built-in settings handle SOCKS5 username/password poorly: an HTTP proxy shows a normal login prompt, while authenticated SOCKS5 usually needs an extension, IP-based access or an antidetect browser. For multi-profile work see our antidetect browser proxy setup guide.

curl and command-line tools

curl -x http://user:[email protected]:8000 https://api.ipify.org

# same thing with credentials passed separately
curl -x http://203.0.113.10:8000 -U user:pass https://api.ipify.org

Telegram

Telegram apps support SOCKS5 with login and password plus their own MTProto proxy type; Telegram Desktop also accepts HTTP proxies. For a messenger-only setup, a dedicated MTProto proxy is the simplest option, while SOCKS5 is useful when the same IP must also serve other apps. More tips are on the Telegram use case page.

Torrent clients and games

Clients such as qBittorrent offer SOCKS4, SOCKS5 and HTTP in their connection settings. SOCKS5 is the usual pick because it can carry peer connections and, where the server allows UDP, some UDP traffic too. Game launchers and clients that use non-HTTP protocols generally need SOCKS5 or a system-wide tool; see proxies for games. Respect each platform's terms of service.

Scrapers and HTTP libraries

Most scraping stacks accept HTTP proxies out of the box. Python requests needs the extra requests[socks] package for SOCKS5, and Scrapy's built-in proxy middleware works with HTTP(S) proxies only. If you build a proxy for web scraping pipeline, HTTP is usually the path of least resistance; our web scraping proxy guide covers rotation and pool size.

# pip install requests[socks]
import requests

proxy = 'socks5h://user:[email protected]:1080'
r = requests.get('https://api.ipify.org', proxies={'http': proxy, 'https': proxy}, timeout=15)
print(r.text)

Connection string formats and how to pick a protocol

Providers and apps write the same proxy in different ways, and a wrong format is the top reason a working proxy "does not connect". The most common variants:

203.0.113.10:1080
203.0.113.10:1080:user:pass
user:[email protected]:1080
socks5://user:[email protected]:1080
http://user:[email protected]:8000

Ports differ by provider: 1080 is the traditional SOCKS port and 8080 or 3128 are common for HTTP, but any port can be used. Some services run both protocols on one port, others use separate ports, so read the delivery details carefully. To convert a whole list between formats and spot broken lines, paste it into the free proxy checker and format converter: it parses all the variants above and flags invalid entries.

Quick decision rules

• Browsing, scraping, SEO tools and anything web-only: HTTP(S) is the easiest and best supported.
• Telegram, games, torrent clients, mail clients and custom TCP apps: choose SOCKS5.
• Need UDP: SOCKS5 with UDP ASSOCIATE, confirmed with the provider before buying.
• Need privacy of DNS lookups: SOCKS5 with remote DNS (socks5h://) or an HTTP proxy.

The protocol is separate from the IP type. TrueSocks sells datacenter IPv4, IPv6 and ISP proxies with HTTP(S) and SOCKS5 support and delivers them right after payment: pick the protocol your software handles best.