Security & Privacy

What you send us

You paste a list of SOCKS5 proxies in the form ip:port orip:port:username:password. That list is sent to our server once, over HTTPS, to be checked.

What we never store

Your username and password are processed entirely in memory for the duration of your check, used only to authenticate with the proxy itself, and then discarded. They are never written to a database, a log file, or any other storage, in any form — not even a hash. We never store your proxy credentials, anywhere, under any circumstances.

The destination IP and port you're checking are handled differently, and we want to be precise about it rather than overstate what we do: they are not written anywhere in plain, readable form. But to detect abusive scanning behavior (see "What we log" below), a one-way cryptographic fingerprint derived from them — not the IP or port itself — is kept for a limited time. If that distinction matters to you, read on.

What we send to a third party — and what we don't

After a proxy passes our check, we look up the country and network (ASN)behind the proxy's exit IP — the IP address the proxy itself reports back, not the address you typed in — so we can show you that information. This lookup is done viaTeam Cymru's free public IP-to-ASN service, queried through Cloudflare's own DNS-over-HTTPS resolver.

Two things about this are worth stating plainly:

• Only the proxy's exit IP is sent to Team Cymru — never theip:port you originally entered, and never any other part of your input.
• Your username and password never leave our system. They are used only to authenticate the SOCKS5 handshake with the proxy itself, and are never sent to Team Cymru, any other third-party service, or logged anywhere — not even in the event of an error.

What we log for abuse prevention

Our request logs never contain proxy credentials, in any form. To detect scanning behavior (for example, one visitor probing many ports on the same address, which risks getting this service treated as an attack tool by our hosting provider), we temporarily keep, per caller:

• A keyed cryptographic fingerprint (HMAC, with a secret key only our server holds) of your own IP address, used only as a lookup key — not your plain IP address.
• For each destination IP:port you check, the same kind of keyed fingerprint of that IP, port, and /24 network — not the plaintext IP or port. This lets us count how manydistinct destinations or ports one caller has probed without ever storing an address or port we, or anyone else, could read back out.

We use a keyed fingerprint (HMAC) rather than a plain hash for both of the above on purpose: an IPv4 address has only about 4 billion possible values, so a plain hash of one can be reversed by brute force in a matter of hours. An HMAC requires our server's secret key to compute, so it cannot be reversed by guessing candidate IP addresses.

This data expires automatically: within about an hour of your last check under normal use, or up to 24 hours if it was used to flag suspicious scanning behavior. It is never a proxy credential, address book, or anything resembling the actual proxy list you pasted.

Reporting a vulnerability

If you've found a security issue in socksv5.net, please emailsecurity@socksv5.net. See also oursecurity.txt file. We ask that you give us a reasonable amount of time to address any report before disclosing it publicly.