SOCKS5 is a proxy protocol that relays TCP and UDP traffic between a client and a server without reading the application data, so it works with any app that supports SOCKS, not just web browsers. It is defined in RFC 1928, supports username/password authentication, and does not encrypt traffic on its own.

Because SOCKS5 operates between the application and transport layers instead of parsing HTTP, it doesn't interpret or modify the traffic passing through it at all; it simply relays the data, which makes it more versatile but also means it can't perform protocol-specific optimizations that an HTTP-aware proxy can. If your use case needs SOCKS5, it's worth confirming a provider supports it before committing.

Because it doesn't parse HTTP headers or rewrite requests, a SOCKS5 proxy can't cache or filter content at the HTTP protocol level the way an HTTP proxy can.

How a SOCKS5 Connection Works

  1. The client connects to the proxy and lists the authentication methods it supports.
  2. The proxy picks one, such as no authentication or username/password, and the client authenticates.
  3. The client sends the destination as an IPv4 address, IPv6 address, or domain name. It uses CONNECT for TCP or UDP ASSOCIATE for UDP.
  4. The proxy opens the connection and relays data in both directions.

SOCKS5 vs. SOCKS4

SOCKS5 extends the older SOCKS4 protocol:

  • Authentication: SOCKS4 has only a user ID field. SOCKS5 adds methods such as username/password and GSSAPI.
  • UDP: SOCKS4 handles TCP only. SOCKS5 can also relay UDP.
  • IPv6: SOCKS4 accepts only IPv4 destinations. SOCKS5 adds IPv6.
  • Hostnames: SOCKS5 lets the client send a domain name for the proxy to resolve. SOCKS4 needs the SOCKS4a extension to do this.