HTTPS proxies: what the S means, and what the proxy can see

On a proxy provider’s price list, “HTTPS” means you can visit https:// sites through the proxy. Your software asks the proxy to open a tunnel to the site, and the encryption runs from your software to the site, so the proxy passes on bytes it cannot read: not the page, not your form fields, not your cookies. It does see the name of the site you connect to, when, and how much you send. A proxy that you reach over an encrypted connection of its own, an https:// proxy address, hides that site name and your proxy login from your own network as well; Chrome, Firefox and curl support it, but a computer’s own proxy settings generally cannot. And no paid proxy needs you to install its certificate: one that asks can read everything.

Answer · The live comparison uses prices checked up to Oct 24, 2026; every figure in the text keeps the date it was checked.

The tunnel: how a proxy carries an https:// page

For an https:// address, your software sends the proxy a CONNECT request naming the site and port. The proxy opens a connection to the site and from then on only relays bytes in both directions (RFC 9110, section 9.3.6). Your software and the site then agree their encryption through that tunnel, end to end. Chrome’s proxy documentation describes it the same way: “the TLS exchange is forwarded through the proxy using the CONNECT method, so end-to-end encryption is not broken. However when establishing the tunnel, the hostname of the target URL is sent to the proxy server in the clear” (Chromium: proxy support).

The login row is why proxy authentication says to give a proxy password its own, unshared password.

A proxy you reach over TLS

Some proxies can also be reached over an encrypted connection of their own, written https://proxy:port instead of http://proxy:port. Then the CONNECT request, with the site’s name and your login, travels inside that encryption too: Chrome’s documentation notes that “the hostnames for proxied https:// URLs is also not revealed”, and that such a proxy may speak HTTP/2, which avoids the limit Chrome puts on an ordinary HTTP/1.1 proxy: 32 connections at once across all sites.

Support is narrower. Chrome, Firefox and Opera support it, “however, most older HTTP stacks do not”, and “specifying an HTTPS proxy is generally not possible through system proxy settings”: you need a PAC file, a command-line flag or a browser policy (Chromium, as above). curl supports it with the https:// prefix, in versions from 7.52.0 (curl: –proxy). Ask the provider whether its gateway accepts TLS before you build on it.

Never install a proxy’s certificate

A proxy can read an https:// page only if your device trusts a certificate the proxy controls, so it can pose as every site you visit. Office networks that inspect traffic work this way, on devices they manage. A proxy you buy to reach sites does not need it, so a setup guide that asks you to install the provider’s root certificate is asking to read and change everything you send, logins included.

What the S does not change

Encryption decides who can read your traffic, not how a site treats the proxy’s address. A site still sees the proxy’s address, may judge it by the network it comes from, and may compare it with your browser’s other signals; proxy anonymity levels covers what a site checks. Over https://, the “transparent” and “anonymous” levels mostly stop applying, because the proxy cannot add anything to a request it cannot read.