What is SOCKS5? How do SOCKS proxies work?

Privacy newsTips & tricks
2 mins
Socks with a shield pattern hanging on a line.

A proxy server is a device or application that acts as an intermediate for transmitting data online. In a broader sense, any device between you and the server of the site you are visiting acts as a kind of proxy, but we tend to apply the term proxy to devices, programs and servers that make specific decisions on how to route data.

Types of proxies

A VPN server is also a kind of proxy, as is the VPN software installed on your computer. Most proxies are built only for web traffic, e.g., over the HTTP protocol, but VPN software is designed to reroute all data sent out by your machine. VPN connections are generally encrypted, but exactly how can differ from provider to provider, and many providers will offer multiple protocols.

There are different protocols for HTTP proxies, too. Most commonly web proxies are used to forward simple HTTP requests. For those running their own server, apache or nginx are popular web proxies used to serve content to site visitors. A content delivery network is an example of such a web proxy, too. The ExpressVPN onion site is also a web proxy between the darknet and our normal clearnet site.

[Learn more about privacy technology. Sign up for the ExpressVPN Blog Newsletter.]

What is SOCKS?

SOCKS (Socket Secure) is a highly popular proxy protocol used to route packets. As an application, it can run on your local machine or remotely on a server. While it can be used to route any data, an HTTP connection has to be first established between you and the SOCKS server. 

Unlike a VPN, your applications such as your browser or Bitcoin wallet need to support the SOCKS protocol to be able to use it. While it would be possible to install a tool that captures all your network traffic and sends it to a SOCKS proxy, such tools are not commonly used.

SOCKS was launched in 1992. It didn’t take long for new versions to appear, and its fourth iteration, called SOCKS4 is still in use today. The latest version, SOCKS5, was released in 1996, and has been running on countless machines since.

SOCKS5: A reliable standard

The most likely place you are to encounter SOCKS5 configuration settings are network applications installed on your computer, such as file-sharing tools like Dropbox, voice over IP applications, chat applications, and Bitcoin wallets. The most common SOCKS5 application you might have installed is Tor, on port 9050 by default.

Once Tor is running on your machine, you can configure these SOCKS5-compatible applications to route all traffic through the Tor network by entering the details of your Tor SOCKS5 proxy (IP and port: 127.0.0.1:9050). As Tor is running on your local machine you likely won’t configure it with authentication, but for a SOCKS5 server running on a remote server, this is an important feature.

SOCKS5 vs. VPN

ExpressVPN does not offer a SOCKS5 proxy on its servers or applications; in fact, it does not make a lot of sense to do so. While both SOCKS5 and a VPN can give you a different IP address to conceal your location and hide your identity, only a VPN offers online security by protecting your data. Your ExpressVPN app routes all traffic from your device through its secure, encrypted tunnel to the VPN server, from where it reaches its final destination.

Lexie is the blog's resident tech expert and gets excited about empowerment through technology, space travel, and pancakes with blueberries.