SOCKS4 vs SOCKS5

Both versions do the same basic job: relay a TCP connection from your app through the proxy's IP, without reading the data. SOCKS5 adds everything a modern network needs around that job.

SOCKS4 was written in the early 1990s to let programs inside a company network reach the internet through a firewall (SOCKS 4 protocol). A client sends one short request with the version number 4, the command (connect or bind), the destination port, the destination IPv4 address and a user ID string. The proxy answers with "granted" or "rejected" and then relays bytes.

That design has three limits that matter now:

• No password. The user ID is a plain label the server may check against an ident service; it is not a credential. Paid proxy services cannot authenticate customers with it, so SOCKS4 proxies are usually open or protected only by an IP allowlist.
• IPv4 only. There is no field for an IPv6 address.
• The client resolves host names. It must look up the site's IP itself before it connects, so the DNS lookup happens on your machine and your own resolver sees it.

SOCKS4a is a small extension that fixes the DNS limit (SOCKS 4A). The client sends a dummy IP address of the form 0.0.0.x and adds the host name after the user ID, and the proxy resolves the name itself. It changes nothing else: still no password, no IPv6, no UDP.

SOCKS5 is a new protocol, published as RFC 1928 in 1996, not an extension. It starts with a negotiation step: the client lists the authentication methods it supports, the server picks one, and only then does the client send its request. Compared with SOCKS4, it adds:

• Real authentication: username and password (RFC 1929), GSS-API, or no authentication, chosen in the handshake.
• Address types: IPv4, IPv6 or a domain name, so the proxy can resolve names and reach IPv6 sites.
• UDP ASSOCIATE: a command for relaying UDP datagrams, used for DNS, voice, games and QUIC, where the server supports it.
• Clearer replies: error codes that say why a connection failed, such as "host unreachable" or "connection refused".

What SOCKS5 does not add is encryption. Like SOCKS4, it relays traffic as it is; HTTPS sites stay encrypted by their own TLS, and the hop to the proxy, credentials included, is not encrypted. More on this in SOCKS5 vs HTTP proxy.

Most tools choose the version by the scheme of the proxy URL. In curl and many libraries:

# SOCKS5 with a password, DNS resolved by the proxy
curl -x socks5h://<login>:<password>@gate.proxyfield.io:7000 https://api.ipify.org

SOCKS5 port at ProxyField: the same gate.proxyfield.io:7000 as HTTP and HTTPS; SOCKS5 with a username and password: yes, with the same username and password as HTTP. A client set to socks4:// cannot pass a password, so it cannot use a password-protected SOCKS5 service; switch the scheme instead. More in curl with a proxy.

Use SOCKS5. It does everything SOCKS4 does, and it is the version proxy services, browsers and libraries support with credentials. Choose SOCKS4 or SOCKS4a only when an old program offers nothing else, and then prefer an IP allowlist to protect the proxy, since SOCKS4 has no password.

For web scraping, the choice between SOCKS5 and HTTP(S) matters more than the SOCKS version: most scrapers use HTTP proxies, and SOCKS5 suits apps that are not web clients. Buying options are on SOCKS5 proxies.

Need SOCKS5 on residential IPs? ProxyField residential proxies run over SOCKS5, HTTP and HTTPS on 412M+ IPs in 195+ countries, from $1.95/GB with no subscription. Start with the Easy Trial: 1 GB for $2.95. Traffic never expires, and all purchases are final.