Developers
Which protocol to point a client at, and the socks5 or socks5h scheme to set in it once the proxy is switched.
SOCKS5
SOCKS5 Proxies
SOCKS5 is a transport-level proxy protocol: it opens a connection on your behalf and moves bytes, without reading or rewriting what is inside them. Every static ISP proxy we sell can be switched between HTTP and SOCKS5 on the order you already hold.
Switching protocol is not a different product: you switch the proxy you already hold, from the dashboard or the API, and the order is updated with the new port and credentials to connect with.
In short: SOCKS5 is a proxy protocol, not a kind of address: it relays a TCP connection without reading or rewriting what is inside. Every static residential (ISP) proxy ProxyJam sells runs HTTP, which carries HTTPS, or SOCKS5, and you switch between them on the order you already hold; after the switch, connect with the port and credentials the order shows.
SOCKS5 carries anything your client can open a TCP connection for, including traffic an HTTP proxy cannot forward, and it passes the bytes through untouched. That makes it the natural choice for a database client, an SSH session, or any tool that does not speak HTTP. What it does not do is change what the address is. The proxy protocol is spoken between your client and the proxy; the site at the far end sees a connection from the proxy’s address, plus any headers an HTTP proxy chose to add. So the question worth asking is not which protocol to buy. It is which network the address belongs to, and there the answer is a named internet provider, 22 of them in the United States.
What the specifications say
SOCKS version 5 was published in 1996 as RFC 1928, a firewall-traversal protocol that extended SOCKS version 4 with UDP, a framework for authentication methods, and destinations given as domain names or IPv6 addresses. A client offers the authentication methods it supports and the server picks one; the client then asks for an outbound connection (CONNECT), a listening port (BIND) or a UDP relay (UDP ASSOCIATE). Username and password login is its own short specification, RFC 1929, which sends the password in clear text — so keep the traffic inside the tunnel encrypted where it matters.
The domain-name option is what the socks5 and socks5h schemes choose between. curl’s manual describes --socks5 as using the proxy “but resolve the hostname locally”, and --socks5-hostname as the variant that lets “the proxy resolve the hostname”. In a proxy URL, socks5:// gives the first behaviour and socks5h:// the second, as the table in Everything curl sets out. An HTTP proxy carrying HTTPS normally receives the name instead: a CONNECT request names the destination host and port, and the proxy opens the tunnel to it (RFC 9110, section 9.3.6). The UDP relay is part of the SOCKS5 specification, but implementations differ on it; the FAQ below says what that means on our proxies.
HOW THE HANDSHAKE WORKS
What happens between your client and ours
Three short exchanges, none of which involve the proxy understanding your traffic.
Step 01
Your client greets the proxy and agrees on authentication. It offers the methods it supports; the proxy names the one it wants. On our addresses that is a username and password, or nothing at all if you have whitelisted your own IP instead.
Step 02
Your client asks for a destination. A host and a port, sent either as an address or as a name. Sending the name is the interesting case: the proxy resolves it, so the lookup leaves from the proxy’s network rather than from yours.
Step 03
After that the proxy just moves bytes. It does not parse the payload, add headers or know whether it is carrying a web page, a database session or a mail transfer. That indifference is the whole reason to choose SOCKS5 over an HTTP proxy.
PROTOCOL CHOICE
What each protocol carries, and what the proxy can see
| HTTP proxy | HTTPS via CONNECT | SOCKS5 | |
|---|---|---|---|
| What it can carry | HTTP requests only | A TCP tunnel to the host and port named | Any TCP stream |
| Does the proxy read the payload | Yes — it parses the request | No, once the tunnel is open | No, at any point |
| Can it change your headers | Yes — it forwards them and may add its own, such as Via | No, once the tunnel is open | No — it has no notion of a header |
| Where the hostname is resolved | At the proxy | At the proxy — CONNECT names the host | Your choice, at either end |
| Typical client support | Universal in HTTP tooling | Universal in HTTP tooling | Common in command-line tools; some libraries need an extra package |
| Best suited to | Plain web requests | Ordinary HTTPS browsing and scraping | Non-web protocols and mixed traffic |
WHO THIS IS FOR
For deciding which protocol to point a client at
Operators
Which protocol to point a client at, and how to switch the proxy you already hold from the dashboard or the API.
STEP BY STEP
Moving a ProxyJam proxy to SOCKS5
Switch the proxy itself
From the dashboard or with one API call on the order; changing only the client is not enough. The proxy may be briefly unavailable while it switches.
Copy the port, username and password the order shows after the switch
Do not reuse the values you connected with over HTTP.
Set the scheme in your client
socks5h://USERNAME:PASSWORD@HOST:PORTto have the proxy resolve hostnames, orsocks5://to resolve them on your side.Test from a terminal before touching code
curl -x socks5h://USERNAME:PASSWORD@HOST:PORT https://example.com/.Install the SOCKS extra in Python
In Python, requests needs its SOCKS extra,
pip install requests[socks], before asocks5h://proxy URL works.
TECHNICAL DETAILS
What SOCKS5 gives you on our addresses
-
Protocol
- SOCKS5 or HTTP (which carries HTTPS), switched on the order
Authentication- Username and password, or an IP whitelist
Address seen by the target- A static ISP address registered to a named carrier
Carrier choice- 22 named carriers in the United States; a shorter list elsewhere
Coverage- 73 countries in the catalogue, each with the carrier named
Rotation- None — the address does not change during the period
Concurrent sessions- 100 per proxy, 10 past 50 GB a month
Traffic accounting- Per IP per period; transfer is not metered on any protocol
import requests
# HOST, PORT, USERNAME, PASSWORD come with your order (dashboard or API)
proxy = "http://USERNAME:PASSWORD@HOST:PORT"
proxies = {
"http": proxy,
"https": proxy,
}
response = requests.get(
"https://example.com/",
proxies=proxies,
)
print(response.status_code)
# HOST, PORT, USERNAME, PASSWORD come with your order (dashboard or API)
curl -x http://USERNAME:PASSWORD@HOST:PORT \
https://example.com/
import axios from "axios";
import { HttpsProxyAgent } from "https-proxy-agent";
// HOST, PORT, USERNAME, PASSWORD come with your order (dashboard or API)
const proxy = "http://USERNAME:PASSWORD@HOST:PORT";
const agent = new HttpsProxyAgent(proxy);
const response = await axios.get(
"https://example.com/",
{
httpAgent: agent,
httpsAgent: agent,
},
);
console.log(response.status);
package main
import (
"fmt"
"net/http"
"net/url"
)
func main() {
// HOST, PORT, USERNAME, PASSWORD come with your order (dashboard or API)
proxy, _ := url.Parse(
"http://USERNAME:PASSWORD@HOST:PORT")
client := &http.Client{Transport: &http.Transport{
Proxy: http.ProxyURL(proxy),
}}
res, _ := client.Get("https://example.com/")
fmt.Println(res.Status)
}
INSTALLATION
Full setup docsConnect first, then switch the scheme
The samples below connect over HTTP, the protocol an order starts on. To use SOCKS5, first switch the proxy itself, from the dashboard or with one API call; the order then shows the port and credentials to use from now on. In the client, change the scheme to socks5, or socks5h if you want the proxy to resolve the hostname, with that port and those credentials — Python needs requests[socks] for that, and Node.js a SOCKS agent in place of the HTTPS one.
FAQ
Questions about SOCKS5
The answers below state the terms we sell on, and each one that does links to the document that binds us to it.
What is a SOCKS5 proxy?
SOCKS5 is a proxy protocol defined in RFC 1928 that works at the transport layer. Your client asks the proxy to open a connection to a host and port, the proxy opens it, and from then on it forwards bytes in both directions without interpreting them. Because it never parses what it is carrying, it is not limited to web traffic — anything that runs over TCP can go through it.
How is it different from an HTTP proxy?
An HTTP proxy understands HTTP. It reads the request line and the headers, and it is free to add, remove or rewrite them, which is why some proxies quietly announce themselves in a header you did not set. SOCKS5 has no notion of a header at all: it sees a destination and a byte stream. If your traffic is not HTTP, or you would rather nothing in the middle could edit it, SOCKS5 is the one to pick.
Does SOCKS5 encrypt my traffic?
No, and neither does an HTTP proxy. SOCKS5 authenticates you to the proxy and then forwards bytes. The specification lets an authentication method add its own protection, but username and password authentication (RFC 1929) sends the password in clear text and protects nothing after it. If the traffic inside is HTTPS or SSH it is already encrypted end to end, and the proxy cannot read it. If the traffic inside is plaintext, it stays plaintext, so do not treat SOCKS5 as an encryption layer.
What does socks5h do that socks5 does not?
It moves the DNS lookup. With socks5, your client resolves the hostname locally and asks the proxy to connect to the resulting address. With socks5h, your client sends the name and the proxy resolves it. That matters in two ways: your own resolver never sees which hosts you are visiting, and you get the answer the proxy's network gets, which for a geo-varying hostname is often not the answer you would get at home.
Does it support UDP?
UDP ASSOCIATE is in RFC 1928; whether a given client or server implements it varies, so check both ends rather than assuming it. We have not published UDP support for our proxies, so plan on TCP, and ask support before you build anything that depends on UDP.
Do I need a different proxy to use SOCKS5?
No. You switch the proxy you already hold between HTTP, which also carries HTTPS, and SOCKS5 — from the dashboard, or with one call to the API on the same order. It is not only a client setting: the switch is made on the proxy, the order is updated with the new protocol, port and credentials, and the proxy may be briefly unavailable while it happens. The proxy stays yours for the whole period you paid for, it is replaced free if it stops responding or is blocked on a target you named, up to 20 % of the order per calendar month, and the first order carries a 72-hour refund covering up to 10 IPs that testing does not void. Terms of Service
HTTP or SOCKS5?
Stay on HTTP when all you send is web traffic and your tools already speak HTTP proxies. Switch to SOCKS5 when a client has to carry something that is not HTTP, or when you want hostnames resolved at the proxy with nothing in the middle able to edit your headers. Either way it is the same product, ordered on ISP proxies and also described as static residential proxies, with no separate order and no charge for switching. Setup questions are answered on Help. The carrier and country counts on this page are read from the catalogue snapshot the site is built from, as our editorial policy describes.Sources
- RFC 1928 — SOCKS Protocol Version 5 — the 1996 specification: authentication negotiation, the CONNECT, BIND and UDP ASSOCIATE commands, and destinations given as domain names or IPv6 addresses
- RFC 1929 — Username/Password Authentication for SOCKS V5 — the login method, which sends the password in clear text
- RFC 9110 — HTTP Semantics — section 9.3.6: a CONNECT request names the destination host and port, and the proxy opens the tunnel to it
- curl man page —
--socks5resolves the hostname locally,--socks5-hostnamelets the proxy resolve it - Everything curl — SOCKS proxy —
socks5://andsocks5h://in a proxy URL, and which end resolves the hostname