How to check a proxy list
To check proxy servers in bulk, paste one proxy per line, choose HTTP, HTTPS, SOCKS4 or SOCKS5 to match how the proxies work, press Start Check, then copy the results. The whole list is tested against the protocol you selected, so a list that mixes types needs one run per protocol.
- Paste the list into the box, one proxy per line, in host:port form.
- Select the protocol: HTTP, HTTPS, SOCKS4 or SOCKS5.
- Press Start Check. Press Stop if you want to end the run early.
- Press Copy Active to copy the working proxies, Copy Inactive for the failures, or Copy All for both. Keep Active Only removes failed lines from the box.
A list looks like this. These addresses come from the documentation ranges in RFC 5737, so they show the format only and will always fail:
203.0.113.10:8080
203.0.113.25:3128
198.51.100.7:1080
198.51.100.42:1080If you don't know which type a list contains, run it as HTTP and press Copy Active, then Copy Inactive, Clear, paste the failed lines back and run them as SOCKS5. Port numbers give a hint: 1080 is the registered SOCKS port, and 3128 and 8080 are common for HTTP proxies, but any proxy can listen on any port.
What do the proxy check results mean?
Active means the checker opened a connection through the proxy using the protocol you selected. Inactive means it failed or timed out. A free proxy marked inactive now can work again an hour later. When a paid proxy fails, the cause is usually fixable: protocol, login or allowlist.
The common reasons a proxy test fails:
- Wrong protocol: a SOCKS5 proxy checked as HTTP fails, because the first bytes of the handshake don't match.
- Wrong or missing username and password on a paid proxy.
- IP allowlist: many paid proxies accept connections only from addresses you registered with the seller, and the checker connects from a different address.
- Overload or expiry: free proxies come and go without notice, and paid ones stop when the plan ends.
An active proxy can still be blocked by the site you want to reach. Large websites keep their own lists of datacenter ranges and known proxies.
HTTP, HTTPS, SOCKS4 or SOCKS5: which protocol to choose
Choose the protocol the proxy actually speaks, which the seller or list should state. HTTP proxies handle web requests and can read them. HTTPS proxies tunnel encrypted traffic with the CONNECT method. SOCKS proxies relay raw connections for any application, and only SOCKS5 adds passwords, UDP and IPv6.
| Protocol | What it carries | Login support |
|---|---|---|
| HTTP | Plain HTTP requests; the proxy sees and can change headers | Username and password (Proxy-Authorization header) |
| HTTPS (CONNECT) | A TCP tunnel for encrypted sites; the proxy sees the hostname, not the page content | Username and password |
| SOCKS4 | TCP connections only, IPv4 only | A user ID field, no password |
| SOCKS5 | TCP and UDP, IPv4, IPv6 and domain names | Username and password (RFC 1929) |
The CONNECT method is defined in RFC 9110, and SOCKS5 in RFC 1928. For a SOCKS5 proxy checker run, select SOCKS5 even if the seller also calls it a "socks proxy," because a SOCKS4 handshake is different. Some sellers use "HTTPS proxy" for a proxy you reach over TLS rather than one that supports CONNECT; ask if the label is unclear.
Transparent, anonymous and elite proxies
Proxies fall into three anonymity levels. A transparent proxy passes your real IP to the website, usually in the X-Forwarded-For header. An anonymous proxy hides your IP but reveals that a proxy is in use, for example through a Via header. An elite proxy sends neither, so the site sees only the proxy's IP.
The X-Forwarded-For header is the usual leak. A transparent proxy is fine for caching or company filtering, but useless for hiding your address.
To run your own proxy detection test, set the proxy in your browser or system settings, then see the IP address websites see on the CheckIP homepage. If it shows the proxy's IP, the proxy is hiding yours. If it shows your real IP, traffic isn't going through the proxy, or the proxy is leaking it.
Is it safe to use free public proxies?
Free public proxies are risky for anything that involves a login. The operator of an HTTP proxy can read and change every unencrypted page you load, including inserting ads or scripts, and can log passwords sent without HTTPS. Most free lists don't say who runs each proxy.
HTTPS sites passed through a CONNECT tunnel stay encrypted, but the proxy still sees which hostnames you visit and when. Never accept a certificate warning while using a proxy; that's how traffic gets intercepted. Some open proxies are hacked machines whose owners never agreed to relay traffic.
Free proxy addresses are also often already listed for abuse, so mail and logins from them get blocked. Before you rely on one, check if a proxy IP is on a spam blacklist and look up who owns a proxy IP; a "residential" proxy that whois shows on a cloud host isn't what the seller claimed. For work that matters, use proxies you run yourself or rent from a provider that names its company and terms.
Frequently asked questions
How do I know if my proxy is working?
If the checker shows it active, test it from your own device too. From a terminal, curl -x socks5://host:port https://example.com (or http:// for an HTTP proxy) should return the page. A "connection refused" error means nothing is listening on that port; a 407 response means the proxy wants a username and password.
How do I check if I am using a proxy right now?
Open the CheckIP homepage and compare the IP it shows with the one your ISP gave you, or check the network settings. On Windows 11, go to Settings, then Network & internet, then Proxy. On macOS, open System Settings, then Network, select your connection, click Details and choose Proxies.
Why does a proxy work in my browser but fail here?
The proxy most likely allows only your own IP address. Many sellers authorize access by allowlisted IP instead of a password, so your browser connects while the checker, coming from another address, is refused. Add the checker's address to the allowlist or switch the proxy to username and password login. A wrong protocol choice gives the same result.
Can I test proxies that need a username and password?
Proxies that use login details need them in every request, so the checker has to receive them with each line of the list. Paid proxy sellers usually export lists as host:port:user:pass or user:pass@host:port. Proxies that authorize by allowlisted IP need no credentials, but the checker's address must be on the allowlist first.
Do you store the proxies I paste?
The list has to reach the checker so it can open a connection through each proxy. Treat lists with login details as secrets, and change proxy passwords if you've pasted them into tools you don't control. Lists of IP-allowlisted proxies carry no passwords, so they reveal less.