Does a proxy hide your IP address?
A proxy usually hides your IP address (the network address of your connection) from the website: the site receives the request from the intermediary's address.
VPN, Tor, proxies and SOCKS5: which to choose for your task
A VPN (virtual private network) creates an encrypted tunnel through a single operator and can cover all of a device's traffic.
Updated:
Menu
Tor routes the connection through at least three nodes run by different operators, distributing trust, but usually works more slowly. A proxy redirects the traffic of the configured application; SOCKS5 belongs to this category of intermediaries. Smart DNS alters responses from the domain name system, but does not itself encrypt traffic. For everyday connection protection, choose a VPN; for anonymous browsing, choose Tor Browser.
What changes when you connect
Substituting the IP address (the network address of a device) hides the original address from the website. Encryption protects the content over a specific segment of the path, while coverage shows which applications use the connection.
HTTPS (the secure protocol for transferring web pages) encrypts the exchange between the browser and the website, including the segment after the traffic exits the VPN or Tor.
| Tool | IP address the website sees | Encryption of the path from the device | Coverage | Whom you have to trust |
|---|---|---|---|---|
| VPN | The VPN server's address | Up to the VPN server | All traffic directed into the tunnel | The VPN operator |
| Tor Browser | The exit node's address | Several layers up to the exit node | Only this browser | Trust is distributed across the nodes |
| HTTP/HTTPS proxy | The proxy's address, unless the original address is passed on | Depends on the type; an HTTPS proxy protects the segment up to itself | The application using the proxy | The proxy operator |
| SOCKS5 | The proxy's address for connections through it | The protocol itself guarantees no encryption | The configured application | The proxy operator |
| Smart DNS | Usually the user's original address | The service itself does not encrypt traffic | DNS query handling | The DNS operator with respect to those queries |
According to the Tor Project's help documentation, encryption up to a proxy protects against local eavesdropping. It does not replace HTTPS to the website.
What changes when you connect
HTTPS (the secure protocol for transferring web pages) encrypts the exchange between the browser and the website, including the segment after the traffic exits the VPN or Tor.
Encryption protects the content over a specific segment of the path, while coverage shows which applications use the connection.
VPN: a tunnel for the device
A VPN is suitable for simultaneously protecting the connections of a browser, email and other applications. However, installing a client does not confirm that every connection of the device passes through the server: this depends on the route configuration.
Tor: distributed trust
Tor (onion routing) removes layers of encryption at successive nodes. The entry node knows your IP address, and the exit node knows the destination address. Thanks to the distribution of trust, no single node receives both sides of the route.
Tor: distributed trust
For browsing pages, use Tor Browser, a browser configured for privacy protection. Other programs do not connect through it automatically.
Enlarge image
Proxy: an intermediary for an application
An HTTP proxy (an intermediary for web requests) is set in the browser or network settings. A web proxy works like a website for opening other pages. At the same time, the original address may be passed on or revealed by connections that bypass the intermediary: the article does a proxy hide your IP covers this.
SOCKS5: a proxy protocol
SOCKS5 (the fifth version of the SOCKS protocol for relaying connections through an intermediary) is used in programs that support it. It is a type of proxy. According to the SOCKS5 specification, protection depends on the negotiated methods; the name "SOCKS5 VPN" does not confirm the presence of encryption.
Smart DNS: altering responses to name queries
DNS (the domain name system) maps a website's name to a network address. Smart DNS alters the responses for selected resources and can affect regional availability. However, there is no common standard for such services: neither a region change nor access to a specific website can be guaranteed.
Speed, cost and choosing by task
SOCKS5 may require fewer computations without additional encryption, yet this does not guarantee an advantage over a VPN: speed depends on the route and server load. Tor usually has higher latency because of the chain of nodes.
Tor Browser is free of charge. For VPNs, proxies and Smart DNS, the cost depends on the service and the terms of the plan. Paying by itself does not confirm security.
| Task | Preferred tool | What to check |
|---|---|---|
| Hide your IP from a website in one browser | Proxy | Whether the original address is passed on and whether the intermediary is used by all the necessary requests |
| Protect a device's traffic on someone else's network | VPN | Whether the necessary applications pass through the tunnel |
| Reduce the linkability of a user's address and the websites visited | Tor Browser | Whether the latency and website restrictions are acceptable |
| Change only the resolution of domain names | Another DNS; Smart DNS for its special functions | Which responses are changed and why |
| Download content that is legal to distribute via P2P | A VPN that permits P2P or a configured SOCKS5 | The service's terms and the coverage of the client's connections |
P2P (peer-to-peer exchange) includes downloading and sharing files. Tor is not suitable for torrents; the differences between a VPN and a proxy in the client, including restrictions on hiding the address, are covered in the article which to choose for legal P2P downloads.
For protecting the connections of a personal device, you can choose CitadelVPN: your account area provides a subscription link containing a list of connections. You need to add it to a compatible client, refresh the list and select a connection. Then check the mode that routes the device's traffic through the tunnel: importing the link alone does not guarantee this.
CitadelVPN has no app of its own. The connection guide lists v2rayNG, Hiddify, NekoBox, Streisand, V2Box, Shadowrocket and Happ; button names depend on the client and platform.
Who can see information about the connection
The operator of a VPN or proxy knows the original IP address and the destinations of connections, and without HTTPS can read the content. Unknown free proxies also carry risks of logging and malicious substitution of downloads. For more on this, see how safe proxies are.
Tor does not promise complete anonymity: observing both ends of the route may make it possible to correlate connections by timing. The Smart DNS operator receives the domain name queries; changing DNS does not protect the rest of the exchange.
Frequently asked questions
Can my internet provider see that I use a VPN or Tor?
Usually yes, but the content of the protected connection is unavailable to ordinary local observation. This distinction is shown in the guide to network privacy.
Is a system-wide proxy enough instead of a VPN?
Only if the program you need uses that setting and its coverage is sufficient for you. For example, Windows configures proxies and a VPN separately: one connection does not turn into the other.
Does every SOCKS5 proxy handle all of an application's connections?
No. The standard provides for TCP (connection-oriented transmission) and UDP (transmission of individual packets), but UDP support depends on the implementation of the server and client. The protocol's name alone is not enough to verify compatibility.
Which tool to choose
To protect a device's connections, choose a VPN; for anonymous browsing with distributed trust, choose Tor Browser. Proxies and SOCKS5 suit a single application but do not guarantee encryption. Smart DNS changes name resolution while keeping the original IP address for most websites. Any of these tools still leaves websites able to identify the user when they sign in to an account.