The main difference between SOCKS5 and HTTP proxies is what they can carry. An HTTP proxy speaks HTTP and tunnels TCP connections with the CONNECT method. A SOCKS5 proxy works one level lower: it relays any TCP connection and can also relay UDP, which calls, games and QUIC need. Neither encrypts your traffic by itself.

This comparison covers SOCKS5 vs HTTP proxy in detail: UDP, DNS and socks5h, encryption with HTTPS proxies and SOCKS5 over TLS, speed, and which one to choose.

SOCKS5 vs HTTP proxy at a glance

HTTP proxy SOCKS5 proxy
Standard HTTP CONNECT (RFC 9110) RFC 1928
TCP Yes Yes
UDP No Yes, if the server allows it
Who looks up domain names Always the proxy Your device or the proxy (socks5h)
Authentication User name and password (Basic) User name and password (RFC 1929)
Encrypted No; an HTTPS proxy adds TLS No; SOCKS5 over TLS adds TLS for TCP
Can read plain HTTP requests Yes, in forwarding mode No
Typical ports 8080, 3128 1080
Built into iOS Settings Yes, per Wi-Fi network No

How an HTTP proxy works

An HTTP proxy understands web requests. It works in two ways:

  • Forwarding. For plain http:// pages, the browser sends the whole request to the proxy, which fetches the page. The proxy sees and can change everything.
  • Tunneling. For anything else, including every HTTPS site, the client sends a CONNECT request and the proxy opens a raw TCP tunnel:
CONNECT example.org:443 HTTP/1.1
Host: example.org:443
Proxy-Authorization: Basic YWxpY2U6czNjcmV0

After the proxy answers 200, the client runs TLS with the website through the tunnel. The proxy only sees the destination name and port. Note that the Proxy-Authorization line is just alice:s3cret in Base64, so on a plain HTTP proxy anyone on the path can read your password.

How a SOCKS5 proxy works

SOCKS5 is a small binary protocol that doesn’t care what you send through it. The client greets the server, agrees on an authentication method, then sends one of three commands:

  • CONNECT opens a TCP connection to an IPv4 or IPv6 address, or to a domain name.
  • UDP ASSOCIATE sets up a UDP relay on a separate port.
  • BIND accepts an incoming connection, used by a few old protocols such as active-mode FTP.

Because SOCKS5 never looks inside your traffic, it works for any app, not only web browsers.

UDP: the biggest practical difference

UDP is used by voice and video calls, many online games, DNS, and QUIC, the transport under HTTP/3. HTTP proxies carry TCP only. A newer standard, CONNECT-UDP, exists but few proxies support it.

SOCKS5 can relay UDP, but only when the server has it turned on and its firewall lets the UDP port through. Many providers don’t enable it, so check before you rely on it.

When UDP can’t go through the proxy, one of two things happens:

  • The app falls back to TCP. Browsers usually switch from QUIC to HTTP/2, so websites still work.
  • The UDP traffic goes directly, or fails. Direct UDP uses your real IP address, which matters if privacy is why you use a proxy.

DNS: remote lookups and socks5h

Before connecting to example.org, someone has to look up its IP address.

  • An HTTP proxy always receives the name in the CONNECT request and looks it up itself.
  • A SOCKS5 client can either look the name up locally and send the IP, or send the name and let the server look it up. The second way is called remote DNS, and tools such as curl write it as socks5h://.

Remote DNS is usually what you want. Your local network doesn’t see which names you look up, and you get the answers that match the proxy’s location, which matters for region-specific sites. Potatso always sends the name for TCP connections, so socks5:// and socks5h:// links work the same. See the SOCKS5 reference.

Encryption: HTTPS proxies and SOCKS5 over TLS

Plain HTTP and SOCKS5 proxies send everything between you and the proxy in the clear, including your proxy password and the names of the sites you visit. HTTPS sites are still encrypted end to end, but plain-HTTP traffic is not.

Two variants add TLS between you and the proxy:

  • An HTTPS proxy is an HTTP proxy you reach over TLS. Everything, including the CONNECT request and password, is encrypted. See the HTTP and HTTPS reference.
  • SOCKS5 over TLS wraps the SOCKS5 connection in TLS. TCP is encrypted, but SOCKS5 still sends UDP outside the TLS connection, so UDP reaches the server unencrypted.

Both still look like a proxy to anyone who inspects the traffic. If you need traffic that’s harder to fingerprint, look at protocols built for it, such as Shadowsocks or Trojan.

Speed

Once a connection is open, both protocols add almost nothing: a few bytes per connection, then your data passes straight through. SOCKS5’s handshake is a little more compact, and HTTP proxies may add a header or two. In practice the server’s distance, load and bandwidth decide your speed far more than the protocol does. Adding TLS costs one extra handshake per connection.

Which should you choose?

  • Choose SOCKS5 if you want to send a whole device through the proxy, or need UDP for calls, games or QUIC. It’s also the better choice for apps other than browsers.
  • Choose HTTP if you only browse the web, your provider only offers HTTP, or you want the built-in iOS Wi-Fi proxy setting, which only accepts HTTP.
  • Choose a TLS variant (HTTPS proxy or SOCKS5 over TLS) whenever the path to the proxy crosses networks you don’t trust, such as public Wi-Fi.
  • Offered both with the same login? Many residential and datacenter providers give you an HTTP port and a SOCKS5 port. Pick SOCKS5, and keep HTTP as a fallback.

Using SOCKS5 or HTTP proxies on iPhone

iOS only has a per-Wi-Fi HTTP proxy setting, with nothing for SOCKS5 or mobile data. Potatso, a free proxy client for iPhone and iPad, supports SOCKS5, SOCKS5 over TLS, HTTP and HTTPS proxies for the whole device on any network. Follow the guide: How to use a SOCKS5 proxy on iPhone. To compare these with encrypted protocols, read Proxy protocols compared.

Frequently asked questions

Is SOCKS5 faster than an HTTP proxy?
Not in any way you'd usually notice. Both add very little overhead once a connection is open. The server's location, load and bandwidth matter far more than which of the two protocols you use.
Does a SOCKS5 proxy encrypt my traffic?
No. Plain SOCKS5 and plain HTTP proxies don't encrypt anything, including your proxy password. HTTPS websites stay encrypted end to end, but to protect the connection to the proxy itself, use SOCKS5 over TLS, an HTTPS proxy, or an encrypted protocol such as Shadowsocks or Trojan.
What is socks5h?
socks5h means the proxy server, not your device, looks up the site's domain name. Tools such as curl use the socks5h:// scheme for it. It keeps DNS lookups off your local network and gives you the answers the proxy's location sees.
Can an HTTP proxy handle HTTPS websites?
Yes. The client asks the proxy to open a tunnel with an HTTP CONNECT request, then runs TLS with the website through it. The proxy sees the site's name and port, but not the pages or data.
Which proxy type supports UDP?
SOCKS5, through its UDP ASSOCIATE command, if the server has it turned on. HTTP proxies carry TCP only, so voice calls, many games and QUIC can't go through them.

Also available in: 简体中文 · 繁體中文 · 日本語 · Русский