what a SOCKS5 proxy is article we introduced the concept. Here we look inside the protocol: which bytes travel between the client and the server, how the address is specified, and why this design produces a more general-purpose tool than an HTTP proxy.
SOCKS5 is a remarkably simple protocol defined in RFC 1928. Its simplicity is the source of its power: it never interprets application-layer data, it only carries TCP (and optionally UDP) traffic.
The Three-Stage Handshake
If no authentication is required, three round trips become two. It needs slightly more round trips than the HTTP proxy's CONNECT method, but the bytes are far smaller.
Stage 1 — The Greeting
In its first packet the client announces the protocol version and the authentication methods it supports:
The server announces its choice with a single-byte reply: 0x00 (no authentication required), 0x02 (username/password) or 0xFF (no acceptable method).
The server sends 0xFF and closes the connection, it means your client is not offering the authentication method the server expects. This is the most common cause of the "the connection closed silently" complaint.
Stage 2 — Authentication
If method 0x02 is selected, the sub-negotiation defined in RFC 1929 takes place: a version byte, the username length and the username, the password length and the password. The server returns a single-byte success/failure.
For a detailed comparison and practical configuration, see our SOCKS5 authentication article .
Stage 3 — The CONNECT Request
Once authentication has passed, the client announces the target. This is where SOCKS5's most important design decision comes into play: the address can be given in three different formats.
ATYP=0x03 means a domain name; in that case DNS resolution is performed by the proxy. This single byte is the key to preventing DNS leaks.
Why Is It More General Than an HTTP Proxy?
An HTTP proxy reads and interprets the request; SOCKS5 only carries it. That is why e-mail, gaming, file transfer and browser traffic can all pass over SOCKS5 at the same time.
| Feature | HTTP proxy | SOCKS5 |
|---|---|---|
| The layer it operates at | Application (7) | Session (5) |
| Protocol support | HTTP(S) only | Any TCP, optionally UDP |
| Content interpretation | Yes | No |
| Header injection | Can | Cannot |
| Caching | Possible | Not possible |
| DNS resolution | On the proxy side | Selectable (ATYP) |
| Handshake round trips | 1 (CONNECT) | 2–3 |
For a detailed comparison, see the difference between an HTTP proxy and SOCKS5 article.
Does SOCKS5 Encrypt?
No. This is the most common misunderstanding. SOCKS5 is a transport protocol; it offers no encryption. The security of your traffic depends on the encryption of the content being carried:
- If it goes over HTTPS: TLS protects it end to end; the proxy cannot see the content.
- If it is plain HTTP: The proxy operator can read the content.
- Credentials: The SOCKS5 username/password is sent in plain text.
SOCKS5 credentials are transmitted unencrypted. If you use a SOCKS5 proxy on an untrusted network, your credentials can be read by an observer in between. In that scenario it is safer to use SOCKS5 over an SSH tunnel — we explain the method a separate article in detail.
Practical Use
socks5h scheme's h means "hostname" and makes DNS resolution happen on the proxy side. Always prefer it to prevent leaks.
When Should You Choose SOCKS5?
Choose SOCKS5
- If you will carry non-HTTP protocols (e-mail, FTP, gaming).
- If you want DNS resolution done on the proxy side.
- If you need UDP traffic.
- If you do not want the proxy touching your headers.
- If the application only supports SOCKS.
An HTTP proxy is enough
- If you will only carry web traffic.
- If you want caching.
- If your tool only supports HTTP proxies.
- If the lowest possible number of handshake round trips matters.
- If you need corporate filtering rules.
Summary
SOCKS5 is a simple session-layer protocol that carries TCP and UDP traffic without ever looking at application data. Thanks to its three-stage handshake, its support for three different address types and the domain name option, it makes preventing DNS leaks possible. It provides no encryption; security depends on the encryption of the content being carried. If you need to carry non-web traffic, it is the right tool. For product details, see our SOCKS5 proxy page, and for testing, our proxy checker tool .