What is SOCKS5?
SOCKS5 is a session-layer proxy protocol, defined in RFC 1928, that relays TCP connections and can relay UDP datagrams for any application rather than only web traffic. It negotiates an authentication method first, then takes a target given as an IPv4 address, an IPv6 address or a domain name and forwards bytes without interpreting them.
A session opens with a short greeting made of the version byte 0x05, a method count and the authentication methods the client accepts. The server picks one, commonly 0x00 for none or 0x02 for the username and password scheme in RFC 1929, and says so. Those credentials cross the wire in the clear, so anyone on the path can read them; TLS inside the tunnel protects your payload and does nothing for the SOCKS negotiation itself. The client then sends a request naming a command and a destination.
Three commands exist. CONNECT (0x01) opens an outbound TCP connection and is what proxy clients use almost all of the time. BIND (0x02) asks the proxy to listen for an inbound connection, which active-mode FTP once needed. UDP ASSOCIATE (0x03) sets up a datagram relay. Address type 0x03 carries a domain name, which lets the proxy resolve DNS on its own side, and that is what curl's socks5h scheme and Firefox's proxy-DNS switch turn on. Plain socks5 resolves locally and hands the hostname to your own resolver.
Nothing in the protocol touches HTTP. There are no headers to add or strip, so a SOCKS5 proxy cannot append X-Forwarded-For or rewrite a User-Agent, and it cannot cache anything. That neutrality is why it carries SSH, database clients, mail protocols and game traffic as happily as browsers, and why an anti-bot system learns nothing extra from the fact that you used one. Whatever your client builds arrives at the origin exactly as it was built, from a different IP.
UDP ASSOCIATE is the part most providers skip. The relay needs a datagram socket of its own and survives NAT badly, so plenty of mobile and residential networks return a failure reply for it while CONNECT works normally. Test rather than assume. Port 1080 is the traditional listening port, though commercial endpoints hand out arbitrary ones, and a single endpoint often speaks HTTP CONNECT on one port and SOCKS5 on another. A tester that reports the actual handshake reply code tells you more than a browser that quietly falls back.
Where you meet it
You reach for SOCKS5 when the traffic is not HTTP, or when a tool refuses an HTTP proxy. An ssh -D tunnel or a database client goes through it without complaint. The recurring failure is a hostname resolved at home instead of at the exit, which shows up as a DNS leak or as localised content matching your real country rather than the proxy's. Switching the scheme from socks5 to socks5h fixes it in curl and in most Python tooling.
Common questions
Is SOCKS5 faster than an HTTP proxy?
Neither is inherently faster. SOCKS5 does less parsing per request, but throughput and latency are dominated by the route, the exit network and how well your client reuses connections. On a mobile exit, radio conditions swamp any protocol difference. Pick SOCKS5 for what it can carry, not for speed.
Does SOCKS5 encrypt my traffic?
No. SOCKS5 is a relay protocol with no encryption of its own, and its username and password exchange is plaintext. Anything private has to be encrypted above it, which HTTPS, SSH and most modern protocols already do. Use IP allowlisting or a trusted network path if the credentials themselves are sensitive.
What is the difference between socks5 and socks5h?
They are the same protocol; the h changes where DNS resolution happens. With socks5 your machine resolves the hostname and sends an IP to the proxy. With socks5h the hostname goes to the proxy, which resolves it at the exit. Use socks5h whenever you care about DNS leaks or geo-accurate results.
Related terms
Real 4G/5G mobile and residential IPs
PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.