SOCKS5 vs HTTP proxy: how they differ and which to use

How does an HTTP proxy carry HTTPS traffic?

An HTTP proxy carries HTTPS traffic through a tunnel that your client opens with the CONNECT method from RFC 9110. The client names the host and port, the proxy connects to it and answers 200, and from then on it only relays encrypted bytes.

The exchange looks like this, with documentation credentials:

CONNECT api.ipify.org:443 HTTP/1.1
Host: api.ipify.org:443
Proxy-Authorization: Basic VVNFUk5BTUU6UEFTU1dPUkQ=

HTTP/1.1 200 Connection established

How does a SOCKS5 proxy open a connection?

A SOCKS5 proxy opens a connection in three short binary exchanges defined by RFC 1928: a greeting that agrees on an authentication method, the login, and a connect request with the target address. The table shows the bytes for a login with username and password (RFC 1929) and a request for api.ipify.org on port 443.

RFC 1929 sends the username and password in clear text, each up to 255 bytes. Like Basic authentication over HTTP, it protects nothing by itself; the TLS session to the website runs inside the relay afterwards. An IP allowlist avoids sending a password at all. Login options: Username and password, or an IP allowlist (up to 10 IPs).

What is the difference between socks5 and socks5h?

With socks5://, your own machine resolves the hostname and sends the proxy an IP address; with socks5h://, the proxy receives the hostname and resolves it. The "h" stands for hostname. The names come from curl and are also used by Python requests with PySocks.

The difference matters in two ways. First, local resolution sends a DNS query from your own network, which tells your resolver which sites you visit. Second, the DNS answer you get locally may point to a server near you, not near the proxy, so a CDN can serve you the wrong region. Use socks5h:// unless you have a reason not to. HTTP proxies always resolve on the proxy side, because CONNECT carries the hostname.

curl -x socks5h://USERNAME:[email protected]:PORT https://api.ipify.org
curl -x http://USERNAME:[email protected]:PORT https://api.ipify.org

Does SOCKS5 support UDP?

The SOCKS5 standard defines UDP relaying through a command called UDP ASSOCIATE, but support depends on the server and the client. Many proxy services and many client libraries implement only TCP.

RackProxies sells its IPs for HTTP, HTTPS (CONNECT) and SOCKS5, and we do not promise UDP. If your use needs UDP, test it on the 1 IP plan before buying more, and ask support first. For web requests, APIs and monitoring over HTTPS, TCP is all you need.

Which one should I pick for my tool?

Pick HTTP when your tool speaks HTTP, and SOCKS5 when it does not or when it supports only SOCKS. In practice:

• Python requests, Node.js fetch with undici, Playwright, Scrapy: HTTP works out of the box. SOCKS5 needs an extra package in requests (requests[socks]).
• curl and wget: curl supports both; wget uses HTTP proxies.
• Browsers: both, but Chromium's built-in SOCKS5 client has historically not supported username and password authentication, so the safe choice is the HTTP form or the allowlist.
• Non-HTTP TCP clients (database tools, custom protocols): SOCKS5.

The code examples show each case, and the quickstart tests both protocols with curl.