What Is a SOCKS5 Proxy and Which SOCKS5 Proxy Should You Choose?

A SOCKS5 proxy is a proxy protocol that forwards your application's TCP connections to the target server without inspecting their content, and it supports username / password authentication. An HTTP proxy only understands web traffic, while SOCKS5 is protocol-agnostic: a browser, a scraper, an email client or a game client can all connect the same way. The standard is defined in RFC 1928.

SOCKS5 is a connection protocol, not an IP type. Whether the exit IP comes from a residential, datacenter or ISP source is a separate choice. At WeProxy, Rotating Residential IPv4, Static Residential IPv4, Rotating Datacenter IPv4, Static Datacenter IPv4 and Static ISP IPv4 all offer SOCKS5 alongside HTTP. This page first explains how the protocol works, then how to choose between these products.

Packages and current prices are in the package table on this page. For the technical differences between HTTP and SOCKS5 in detail, see our HTTP vs SOCKS5 guide.

How does a SOCKS5 proxy work?

A SOCKS5 connection starts with a short handshake. The client connects to the proxy over TCP and lists the authentication methods it supports. The proxy picks one; if username / password is selected, the client sends its credentials. The client then sends a command: CONNECT for a TCP connection, UDP ASSOCIATE for UDP.

With CONNECT, the client gives the target either as an IP address or as a domain name. The proxy connects to the target and from then on relays bytes in both directions as they are. The proxy does not interpret those bytes; HTTPS, SMTP, IMAP or a custom game protocol all pass through the same tunnel. The target server sees the proxy's exit IP as the source of the connection, not yours.

This design has two consequences. First, SOCKS5 does not touch request headers; whatever User-Agent or cookies the client sends reach the target unchanged. Second, the application must support SOCKS5. Most browsers, curl, Python libraries and automation tools support it directly.

What is the difference between SOCKS5 and HTTP(S) proxies?

An HTTP proxy reads the HTTP request and forwards it to the target itself. For HTTPS it opens a TCP tunnel with CONNECT. SOCKS5 is a general-purpose tunnel from the start. Both work for web scraping and APIs; the difference shows in non-web traffic and in DNS resolution.

SOCKS5 is not inherently faster. With both protocols, speed depends on the exit IP's location, the target server and the network path. The choice comes down to what your application supports and what traffic you carry.

socks5 or socks5h: where is DNS resolved?

In SOCKS5 the client decides who resolves the domain name. If the client resolves the name itself and sends an IP address to the proxy, the DNS query goes to the resolver on your own network. If it sends the name as is, the proxy resolves it. In curl and Python this is expressed through the scheme: socks5:// uses local DNS, socks5h:// leaves resolution to the proxy.

If you use a proxy for location or privacy, prefer socks5h. Local resolution can send you to a server outside the proxy's country and make your DNS queries visible on your own network. The steps to close DNS and WebRTC leaks are in our DNS leak guide.

To test the connection:

curl -sS -x "socks5h://USER:[email protected]:8989" https://api.ipify.org

The command should return the proxy's exit IP. Connection details are shown in the dashboard per product; if the dashboard lists a different host and port for your product, use those in the command. Percent-encode the password if it contains @, : or /. To test the proxy outside a browser, you can use the proxy checker.

How does authentication work with a SOCKS5 proxy?

SOCKS5 has two common methods: username / password and IP whitelist. Username / password is sent in the handshake and works from whatever network you connect from. With an IP whitelist, the proxy only accepts connections from registered IP addresses, and you do not need to enter a password in the client.

According to the WeProxy site FAQ, username / password and IP whitelist can be used on packages over both HTTP and SOCKS5. The Static Residential IPv4 product card lists username / password as its authentication method. Check the method you want to use on the relevant product page before you buy.

On rotating products the username also controls the session. By adding a session ID to the username you can keep the same exit IP for up to 24 hours on the residential pool. Without a session ID, each connection may exit from a different IP. The difference between sticky and rotating sessions is covered in our sticky vs rotating guide.

Some tools expect proxies as ip:port:user:pass, others as a URL. Instead of rewriting them by hand, convert them with the proxy format converter.

Which SOCKS5 proxy options does WeProxy offer?

All five products below offer HTTP and SOCKS5. They differ in IP source, session model and billing.

Rotating Residential IPv4 offers city and ZIP targeting and covers more than 180 countries. It suits scraping and SEO tracking where independent pages are collected.

Static Residential IPv4 keeps the same IP for the package period, with unlimited traffic on each IP. The Türkiye location provides IPs from the Türk Telekom and Vodafone networks. Locations outside Türkiye also include SOCKS5 UDP and p0f OS spoofing.

Rotating Datacenter IPv4 is built for fast, high-volume jobs, with ASN and city targeting. On targets that do not block datacenter IPs it keeps the cost per unit of traffic low.

Static Datacenter IPv4 gives you dedicated IPs with a fixed ASN and location and unlimited bandwidth. It is offered in the US, the United Kingdom, the Netherlands, Germany and Canada.

Static ISP IPv4 provides static IPs over ISP routes and suits long sessions that need a high trust score. It is currently offered only in the US location.

The Mobile 4G/5G Proxy (real SIM) in the catalog supports HTTP only; do not plan it for jobs that need SOCKS5. Rotating Mobile IPv4, on the other hand, offers HTTP / SOCKS5. If you are just starting, you can test your SOCKS5 connection with the 1 GB free trial of Premium Rotating Residential.

Which product supports SOCKS5 UDP?

The SOCKS5 standard defines the UDP ASSOCIATE command for UDP, but not every SOCKS5 service enables it. In the WeProxy catalog, UDP support is listed only on Static Residential IPv4 and only in locations outside Türkiye: the US, Germany, France, the Netherlands, Spain, Canada, the United Kingdom, Australia, Hong Kong and Italy.

Static residential packages in the Türkiye location offer HTTP and SOCKS5 without UDP. Other products list their protocol as HTTP / SOCKS5 and do not list UDP. If you are planning a job that uses UDP, such as gaming, VoIP or WebRTC, see our UDP proxy page and our SOCKS5 UDP guide.

How do you choose a SOCKS5 proxy?

Define the job first, not the protocol. SOCKS5 works the same way across several products; IP type, session model and billing decide which product is right.

1. Confirm your application supports SOCKS5. The settings screen should have a SOCKS5 option and an authentication field. If the application only accepts HTTP proxies, SOCKS5 brings no advantage.
2. Identify the traffic type. If you only carry web and API traffic, HTTP is enough. Non-web TCP or UDP traffic needs SOCKS5; for UDP, choose Static Residential IPv4 outside Türkiye.
3. Pick a session model. If you need a different IP on every request, choose rotating; if you need a fixed IP for the same account or session, choose a static product. Sticky sessions on rotating products are a middle ground.
4. Match the IP type to the target. On targets that block datacenter IPs, use residential or ISP. On targets that do not, datacenter is more economical.
5. Verify the location. Static ISP IPv4 is offered only in the US, Static Datacenter IPv4 in five countries. All countries are listed on the locations page.
6. Match billing to volume. Per-GB packages suit variable traffic; per-IP monthly packages suit steady traffic and a fixed number of IPs. GB never expires and stays in your balance until used.
7. Check the DNS setting. Enable socks5h or "remote DNS" in your client and verify the exit IP.
8. Start small and follow the rules. Test a small package with your real client. Follow the target sites' terms and our Acceptable Use Policy.

A price comparison of the products is on the pricing page; you can complete a package on the order page. You can also compare fixed-IP options on our private proxies page and rotating options on our rotating proxies page.

How do you diagnose SOCKS5 connection errors?

SOCKS5 errors arrive as a reply code in the handshake, not as an HTTP status. If authentication fails, the proxy closes the connection; curl then reports a SOCKS handshake error. Check the username, password and percent-encoding first. If you use an IP whitelist, make sure the IP you connect from is registered in the dashboard.

If no connection is established at all, test whether your local network can reach the proxy port with the port checker. If the proxy replies "command not supported" (0x07), the client is most likely sending UDP ASSOCIATE on a package without UDP support. Responses such as 403 or 429 that arrive after the tunnel is up come from the target site. Which layer each error comes from is explained in our proxy error codes guide.

Frequently asked questions

What is a SOCKS5 proxy used for?

A SOCKS5 proxy forwards your application's connections to the target through its own exit IP. Unlike an HTTP proxy, it is not limited to web traffic: desktop applications, email clients, game clients and scraping tools can all use the same tunnel. It does not touch request headers, and with socks5h it can leave DNS resolution to the proxy. For web scraping and automation it does the same job as HTTP.

Is SOCKS5 or an HTTP proxy better?

It depends on the job. If you only carry web pages and API traffic, both protocols work; pick the one your tool supports. Non-web TCP traffic, UDP, or flows where headers must stay untouched need SOCKS5. At WeProxy, all five products on this page offer both protocols together, so the protocol choice does not change the product choice.

Does a SOCKS5 proxy encrypt traffic?

No. SOCKS5 is a tunneling protocol and adds no encryption of its own. Whether traffic is encrypted depends on the protocol your application uses: connections over HTTPS or TLS stay encrypted through the proxy. If you carry an unencrypted protocol over SOCKS5, the content remains readable. For privacy, use HTTPS and choose socks5h to prevent DNS leaks.

Does WeProxy's SOCKS5 proxy support UDP?

Only on Static Residential IPv4, in the ten locations outside Türkiye. These packages are listed as "SOCKS5 + UDP". Packages in the Türkiye location and the other products offer SOCKS5 for TCP only. Confirm in advance whether your application uses UDP; details are on our UDP proxy page.

Can I use an IP whitelist with a SOCKS5 proxy?

According to the site FAQ, username / password and IP whitelist can be used on packages over HTTP and SOCKS5. When you connect via whitelist you do not need to enter a password in the client, but the connection is refused if the IP you connect from changes. Some product cards list only username / password, so check the technical specs on the product page before you buy.

Is there a SOCKS5 proxy with a Turkish IP?

Yes. The Türkiye location of Static Residential IPv4 offers HTTP and SOCKS5 with IPs from the Türk Telekom and Vodafone networks, without UDP. Rotating Residential IPv4 and Rotating Datacenter IPv4 can also be used with SOCKS5 in many countries, including Türkiye. For a full comparison of Türkiye products, see our Turkey proxy page.