What is a proxy vs VPN, and what each one covers

What a proxy does with a request

AWS describes the path in five steps. The client sends a web request and it goes first to the client’s proxy server. The proxy replaces the client’s IP address with its own, forwards the request to the application server, takes the response and passes it back to the client. AWS adds that with a forward proxy the server is not aware of the actual client and thinks the proxy is the client. Norton gives the same sequence as a proxy that sends an identical request to the intended web server, and TechRadar says that to any server you interact with you will look like you are connecting from the proxy server instead of your home connection.

MDN says where the proxy can sit: on the user’s local computer, or anywhere between the user’s computer and a destination server. It also separates two kinds. A forward proxy acts on behalf of clients and can hide the identities of clients, while a reverse proxy can hide the identities of servers. MDN lists load balancing, caching static content such as pictures, and compression among the uses of a reverse proxy, and says there are likely hundreds of thousands of open forward proxies on the Internet. Proton gives the classic reverse proxy as an office intranet that can be reached from outside only through a single server, and limits the rest of its article to forward proxies. The question in the title is about the forward kind, so that is the one this page follows unless a source says otherwise.

A forward proxy that speaks HTTP still has to deal with sites on HTTPS. MDN explains that the HTTP protocol specifies a request method called CONNECT, which starts two-way communications with the requested resource and can be used to open a tunnel. That is how, MDN says, a client behind an HTTP proxy can reach websites that use TLS on port 443. It adds that not all proxy servers support CONNECT, and some limit it to port 443 only.

A browser also need not send everything to the proxy. MDN describes a Proxy Auto-Configuration file, a JavaScript function that decides whether browser requests go directly to the destination or are forwarded to a web proxy server. The function is called FindProxyForURL, and MDN’s example returns DIRECT for hosts that can be resolved and a proxy address for the rest.

Where the VPN differs, and where the pages say it does not

The three VPN sellers agree on the broad contrast and put it differently. NordVPN says a proxy usually applies to a single app, most often a browser, while a VPN works at the operating-system level, routes traffic from all apps and encrypts the connection between the device and the VPN server. Norton says a proxy only changes your IP for the specific app or site you set it up for and does not typically encrypt your data. Proton says most proxies must be configured on a per-app basis, while a VPN protects the entire internet connection.

On encryption the pages are careful about HTTPS. NordVPN says HTTPS keeps the connection between the browser and the website encrypted, but the proxy does not add encryption between the device and the proxy server. TechRadar makes the point from the other side: critical details such as bank passwords are encrypted before they leave the device, it says, yet a third party would still see the websites requested and any plaintext traffic. Proton says the connection between your computer and a proxy server is not always secured with encryption, but often is, and describes connections to commercial proxies as almost always secured with HTTPS. The pages therefore differ on the stretch to the proxy: NordVPN describes a standard HTTP or HTTPS proxy as not encrypting it, and Proton says it often is encrypted. Read together, they leave the answer depending on how the proxy is set up.

Is a VPN a separate thing, then? AWS says you can think of VPN servers as forward proxy servers that also encrypt data. Proton says a VPN server is a specific kind of proxy, and calls the habit of contrasting VPNs with proxies inaccurate and confusing. Where Proton draws a line between a VPN and most other encrypted proxy set-ups, it names the per-app point above, the protocols a VPN uses, and the fact that VPN providers are commercial entities, often subject to public scrutiny. On protocols, Proton names OpenVPN, which it says encrypts the data itself with AES-256, and WireGuard, which uses ChaCha20, as going beyond the plain HTTPS that secures most proxy connections. TechRadar calls OpenVPN the most widely trusted protocol and says PPTP and L2TP are considered outdated and insecure.

Both designs leave someone in the middle. NordVPN says that, depending on how a proxy is set up, the proxy operator may be able to see the traffic it handles, and that the VPN provider remains a central point of trust because it operates the server your device connects to. TechRadar says you cannot be sure a proxy is not scraping the data you send through it, and Proton says that because traffic is encrypted and decrypted by the proxy server, whoever runs it can monitor your activity, which it gives as the reason to use a trustworthy VPN.

The kinds of proxy

When people say proxy without more context, Proton says they usually mean a SOCKS or an HTTP proxy. SOCKS is a low-level protocol that passes along all traffic without trying to understand it. Proton says that makes it useful for mail protocols such as POP3 and SMTP and for BitTorrent, which is why SOCKS proxies are sometimes known as torrent proxies. SOCKS5 gives operators ways to authenticate users, so a commercial service can let in only paying customers, but Proton calls the benefit to people using SOCKS5 rather than SOCKS4 minimal. Norton describes SOCKS5 proxies as working with any type of traffic, naming HTTP, FTP and P2P.

An HTTP proxy understands and interprets web traffic. Proton lists filtering content, restricting access to sites and caching media among what that allows, and also censoring content and injecting advertising banners and malicious code, which it calls a particular problem with free HTTP proxy servers. An HTTP proxy that uses HTTPS for the connection to it is often called an HTTPS proxy. A web proxy is an HTTP proxy that you use inside the browser window, without software or browser settings; Proton says most are free, which it usually counts as a downside because many fund themselves with banners, ads and other scripts.

A transparent proxy is not something you choose. Proton says you may not even know you are using one, and gives public Wi-Fi sign-in portals and the filters on library or school Wi-Fi as benign examples. TechRadar says institutions use transparent proxies mainly to conserve bandwidth by caching popular websites, and that they do not hide the origin of a request, so they are not useful for protecting anonymity.

Commercial proxies are a paid service that connects you to HTTP or SOCKS proxies run by a company, and Proton says those connections are almost always secured with HTTPS. It sorts them by how many customers share an address: shared with many others, semi-shared with a limited number of others (typically three), or exclusive. Proton adds that an exclusive address reduces privacy because the address can be traced back to you. Most run out of data centers, and Proton says those blocks of addresses are sometimes blocked, a tactic of streaming services that restrict content by region. Residential proxies, in Proton’s account, use addresses indistinguishable from real ones at physical addresses and are almost impossible to block.

A private proxy that you set up yourself is a different case. Proton says ownership of the proxy server’s IP address can be easily traced back to you, and says personal private proxies and VPNs are not as good at protecting privacy as commercial VPN services. Public proxies, available to anyone for free, draw the strongest warnings. Proton strongly recommends against them, because there is no way to know who runs the server. Norton says many free public proxies are not safe, since they monetize activity by logging browsing and injecting ads, and NordVPN advises avoiding free VPNs and free proxies. Costs are described differently: Norton says most proxy servers are free to use, yet suggests a reliable paid proxy service or, better still, a VPN.

The proxy’s promise to hide the client’s address is also described with limits. MDN says proxies can make requests appear to come from the proxy’s IP address, which is useful for anonymity, but the address of the original client is often used for debugging, statistics or location-dependent content. A common way to pass it on is through HTTP headers: the standardized Forwarded, or the de facto X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Proto, while Via gives information about the proxy itself. The Norton and TechRadar pages describe the hiding of the address without mentioning those headers. Proton, for public proxies, describes three levels. Level 1 hides the address minimally and the address still appears in the request header. Level 2, anonymous, hides the address but makes no attempt to hide that it is a proxy. Level 3, elite, does not announce that it is a proxy either.

What a proxy is still used for

The pages that favor a VPN do not stop at the verdict. TechRadar says a VPN is the better choice in most scenarios, yet calls proxies great for quick, basic internet tasks. It points out that most browsers and internet-based tools support proxies, so extra software is not needed, and lists reviewing a website from a different location to test things like language support and advertisement coverage, bypassing regional locks on some types of content, and quickly hiding an IP address while sending or receiving content that is not sensitive. It also says marketing agencies use proxies to scrape data from the same websites as they appear in different parts of the world. TechRadar adds a practical difference in switching location: with a proxy you have to find a new proxy in the place you want and paste its address into your proxy software, while a VPN lets you switch in the app, with a kill switch so traffic does not leave over the normal connection during the handover.

NordVPN, in its list of browser-level tasks, names changing the IP address a website sees, reaching web content that only works inside a particular region or network context, testing how a website responds from a different location or IP range, and setting up a proxy for testing, development or learning without full-device encryption. Norton says a proxy can still be useful for changing your virtual location and accessing non-sensitive data, and that for some uses a proxy may be the better option for its simplicity, faster setup and lighter resource use.

Speed is described with care. Norton says proxies are usually faster because they do not encrypt data. NordVPN says a proxy can sometimes feel faster for the same reason, then adds that performance still depends on the proxy’s quality, distance and load, and that free or crowded proxies are often the first to slow down or become unstable. For a VPN, NordVPN says speed is shaped more by the provider’s infrastructure, the server location and the protocol than by the encryption itself. Norton, for its part, lists reduced speed among the downsides of a VPN. The pages we read do not give measured speeds; every speed statement in them is qualitative.

The reverse proxy has its own jobs, and the enterprise page is where they show. AWS says an application server might be overwhelmed by requests during peak periods, and a reverse proxy can act as a load balancer that distributes requests to backup servers, which a VPN does not do. AWS also says a reverse proxy can screen and control traffic to application servers but still allows any outside source to send traffic to it, whereas a client VPN, which it says uses IPsec, only lets authorized devices into the network. For organizations, AWS says a VPN has broader applications than a proxy because it has encryption.

On legality, Norton says a proxy server itself is not illegal, since it is a tool that reroutes internet traffic, but using one for illicit activities is against the law. Norton is the page among the six that answers this for proxies; TechRadar’s disclaimer concerns VPN services and says its testing is done in the context of legal recreational uses.

The jobs the pages steer away from a proxy

TechRadar says proxies should only be used for tasks where security is not critically important, and that your ISP can still see what you do while an extra routing point can see all of your traffic. It describes VPNs as ideal for high-security needs, such as sending personal data on public Wi-Fi. Norton says proxies only hide the IP address and are not safe for private activities such as online banking unless paired with additional security tools, and that they protect traffic only from specific apps or browsers, leaving other activity such as email or messaging exposed.

NordVPN makes the same point about scope. A proxy changes the route for one browser’s requests, it says, while the rest of the device continues to connect to the internet in the usual way. A VPN, once active, sends traffic from the browser and from background apps through its tunnel. NordVPN also says a proxy is typically not designed as a security layer, and that a proxy can reduce what a website learns by changing the IP address but does not, on its own, stop other parties along the path from learning about the connection.

Censorship is a second job the pages treat differently. TechRadar says proxies can be easily blocked by firewalls, whereas advanced VPNs use obfuscation techniques that disguise their traffic as other internet protocols, and it points to regions with strict internet controls. Proton, in contrast, lists a proxy URL, a web address that forwards to another address, as something that can be useful for evading censorship when a URL is blocked, and says it is quite common for individuals to set up private proxy servers to bypass censorship, noting that such a server’s address can be traced back to its owner.

Free proxies come up again here because the warning is about who can see the traffic. NordVPN adds a cost the section on the kinds of proxy did not mention: free services still have to make money, and among the ways it lists are throttling speeds and limiting how much data you can use. The VPN side is not spared in these pages: Norton says free VPNs often have weaker privacy and security and may log or even sell user data, and that a VPN does not protect against malware or phishing on its own.

Both at once, Tor, and what the pages leave out

NordVPN says you can use a VPN and a proxy together, but it rarely adds meaningful protection, can be fiddly to set up, and can turn the proxy into an extra step that slows the connection. It says it is usually better to choose one tool or the other for a given task, and that you generally do not need a proxy if you already have a VPN, while adding that not all proxies are safe and some may collect data. Norton says a proxy on top of a VPN would not offer additional advantages and would likely reduce download speeds. For organizations, AWS says most prefer using only a VPN rather than both a VPN and a proxy server.

Tor is described as a chain of proxies. MDN says forward proxies can be anonymous, and gives Tor as an example that routes internet traffic through multiple proxies for anonymity. Proton says the Tor network routes connections through multiple nodes, encrypting the connection each time, and that each node acts as a proxy server run, at least in theory, by volunteers. Our page on the Tor Browser covers that route, and our page on Tor bridges covers getting in from a network that blocks the front door.

Some questions are left open by the six pages. The pages we read say very little about how a proxy treats the lookup of a site’s name (MDN mentions DNS only in passing, among the services a forward proxy stores and forwards); our guide to Private DNS covers Android’s encrypted lookup. The pages we read do not describe how to check whether an app is using a proxy or a VPN, or how to set a proxy in an operating system. On legality, only Norton gives an answer for proxies, in one short passage.

Who is speaking also matters. Proton, NordVPN and Norton each sell a VPN, and their pages lean toward a VPN (Proton gives no explicit verdict, but says it is crucial to use a trustworthy VPN and that a VPN protects the entire connection). TechRadar says it may earn an affiliate commission from links on its site and recommends VPNs at the end of its page. AWS writes for organizations and treats the reverse proxy as a separate tool. MDN is technical documentation and gives no verdict. Statements from the sellers are used here only for what the pages say, with the seller named.