SOCKS4 vs SOCKS5 proxies: which one to use

Use SOCKS5. It is the version proxy providers sell, and the only one of the two that takes a user name and password, which is how most paid proxies log you in. SOCKS4 carries plain TCP connections to IPv4 addresses and nothing else: no password, no UDP, no IPv6, and your own computer looks up every site name unless your software speaks the SOCKS4a extension. Neither version encrypts anything. Choose SOCKS4 only for an old tool that offers nothing else, and then only with a proxy that lets you in by your IP address.

Answer · The live comparison uses prices checked up to Oct 24, 2026; every figure in the text keeps the date it was checked.

What changed between the two versions

SOCKS4 was written to relay TCP sessions through a firewall. A request carries the destination’s IPv4 address, its port and a user ID, and the server decides whether to allow it, at most by checking that ID against the client machine’s ident service; there is no password (SOCKS 4 protocol). SOCKS4a, a small extension, lets a client that cannot look up a site name send the name instead, so the proxy does the lookup (SOCKS 4A).

SOCKS5, published as RFC 1928 in 1996, rebuilt the start of the conversation: the client and the server first agree on a login method, and the request can name an IPv4 address, an IPv6 address or a site name. It also added a way to relay UDP, the traffic used by DNS lookups, voice calls and many games (RFC 1928). The user name and password login is a separate short standard, RFC 1929, and it sends the password in clear text (RFC 1929).

Why the password decides it

A paid proxy has to know the traffic is yours before it counts it against your plan. Providers do that in one of two ways: a user name and password sent with each connection, or a list of your own IP addresses that may connect without one (proxy authentication compares the two). SOCKS4 cannot carry a password, so with SOCKS4 only the second way is open, and only if the provider’s server accepts SOCKS4 at all. The user name is also where many providers let you choose a country or hold a session, which SOCKS4 has no room for.

Site names, lookups and leaks

When your own computer looks up a site’s address, the lookup goes to your usual DNS server, outside the proxy. Your network and that DNS server can see which sites you visit, and a site can sometimes tell that the lookup came from somewhere other than the proxy. Sending the name to the proxy instead keeps the lookup at the proxy’s end. SOCKS5 and SOCKS4a allow that; plain SOCKS4 does not.

Your software decides which happens. In curl, socks4:// and socks5:// look names up on your computer, while socks4a:// and socks5h:// send them to the proxy (curl manual). Chrome always sends names to a SOCKS5 proxy, cannot use SOCKS4a and, for SOCKS4, always looks names up itself. Chrome also cannot send a SOCKS password from its own proxy settings, for either version (Chromium proxy documentation). With Chrome and a provider that logs you in by password, use the provider’s HTTP address, or allowlist your IP.

Which to pick

• Your software offers SOCKS5: use it, with the name lookup at the proxy (socks5h:// in curl).
• It offers only SOCKS4: use SOCKS4a if it is listed, and log in by allowlisting your IP. If the provider has no SOCKS4 support, use its HTTP address instead; most tools that predate SOCKS5 speak HTTP proxies too.
• The traffic is not web traffic, or uses UDP: SOCKS5, and check that the provider’s page lists UDP, because many SOCKS5 gateways relay TCP only.

The version does not change the price. Where a provider sells SOCKS5, it is usually the same plan and the same addresses as its HTTP proxies, reached on another port or with another scheme. HTTP vs SOCKS5 proxies covers that choice.