SOCKS5 Proxy Basics: How RFC 1928 Relays Any App's Traffic Without Encrypting It

SOCKS5 is the fifth version of the SOCKS proxy protocol, defined in RFC 1928 (IETF, March 1996). It relays an application's TCP connections and, where supported, UDP datagrams through a proxy at the session level, without reading or rewriting the traffic. Login is optional, encryption is absent, and most apps need to be pointed at the proxy individually.

Inside the SOCKS5 handshake

The client starts by listing the authentication methods it supports; the server picks one or refuses. Options are no login, a username with a password (RFC 1929), or Kerberos via GSS-API (RFC 1961). After that the client names the command: CONNECT for an outgoing connection, BIND for an inbound one (old active-mode FTP), or UDP ASSOCIATE for datagrams. The destination can be an IPv4 or IPv6 address, or a domain name plus port. Conventional servers listen on port 1080, though VPN providers often choose their own. SOCKS4 had none of UDP, IPv6 or password login; SOCKS4a only added hostnames. The full flow is in RFC 1928.

SOCKS5 against an HTTP proxy

A game client or torrent swarm cannot talk through a web proxy, while SOCKS5 forwards their bytes as they arrive. For HTTPS the HTTP proxy merely opens a CONNECT tunnel. Neither protocol encrypts the link to the proxy itself. Other proxy server types are covered in the VPNRadarLab glossary.

What SOCKS5 does not encrypt

SOCKS5 adds no encryption of its own. The handshake, the destination, the payload of plain protocols and, with RFC 1929 login, the password itself cross the network in readable form: anyone on the path, from the café Wi-Fi owner to your ISP to the proxy operator, can observe them. Traffic sealed by the app with TLS stays protected end to end. The fixed plaintext pattern also makes the protocol easy for DPI to fingerprint and block. An SSH tunnel with dynamic forwarding wraps the traffic in encryption; tools such as Shadowsocks, V2Ray and Tor clients offer a local SOCKS5 port with an encrypted hop to their servers. Free public SOCKS5 lists deserve extra caution: the operator sees every unencrypted byte and your login.

Why VPN subscriptions bundle a SOCKS5 proxy

The target use case is torrenting. Route only the torrent client through the proxy and it gets another exit IP, while the rest of the device keeps its normal connection, with no encryption overhead eating throughput. Providers usually issue a proxy login that differs from the account password. Three traps: enable peer connections through the proxy, or peers still see your real IP. Confirm the server supports UDP ASSOCIATE if you use UDP trackers or DHT. Make the client stop when the proxy goes down instead of falling back to a direct connection. The proxy alone does not hide what you download from your ISP. It also lets the operator list the peers you connect to.

The 332 services in the VPNRadarLab ranking of 377 consumer VPNs publish nothing on a bundled subscription proxy, 18 deny having one, and 27 confirm it (silence is not a no). IPVanish, TorGuard (as its Anonymous Proxy), PrivadoVPN on the Premium plan and CactusVPN on every server state it explicitly. The full list is in the ranking of VPNs that bundle a SOCKS5 proxy.

Setting up SOCKS5 in apps

• Firefox: Settings, Network Settings, Manual proxy configuration. Fill in the SOCKS Host and Port, pick SOCKS v5, and tick "Proxy DNS when using SOCKS v5".
• qBittorrent: Tools, Options, Connection. Set type SOCKS5 with host, port and Authentication, then enable "Use proxy for peer connections" and "Perform hostname lookup via proxy".
• Telegram: Settings, Data and Storage, Proxy, Add Proxy, SOCKS5.
• curl: prefix the URL with the socks5h scheme or pass --socks5-hostname.
• Windows and macOS offer a SOCKS field in system settings, but many apps ignore it and need their own configuration.

socks5h and DNS leaks

With plain socks5 the client resolves the hostname itself through the local DNS resolver, so the ISP or Wi-Fi owner sees every site name even though the connection rides the proxy. The h in socks5h (a curl convention) stands for hostname: the domain is handed to the proxy, which resolves it remotely. Firefox's tick box does the same thing, and qBittorrent's hostname-lookup option covers the torrent side. Run a DNS leak test after setup; seeing your provider's resolver in the results means lookups still happen locally.

SOCKS5 proxy FAQ

Is a SOCKS5 proxy a VPN?

No, it routes one app and encrypts nothing.

Can a SOCKS5 proxy be detected?

Yes, DPI filters match its plaintext handshake.

Is SOCKS5 enough for torrenting?

It hides your IP from peers, not your traffic from the ISP.

Which port does SOCKS5 use?

1080 by convention; providers often pick another.

SOCKS5 in a few lines

SOCKS5 is a session-level relay for any TCP connection and UDP, with optional password login and no encryption. It swaps the visible IP for one configured app and forwards bytes untouched. Route DNS through it, add encryption where needed and test before a torrent client relies on it.