HTTP proxy

It is the oldest kind and the one most widely sold, and it is also where a careless rule costs the most: name plain http alone and everything encrypted leaves from your own address.

An HTTP proxy is a server that makes web requests on your behalf and opens a plain tunnel for the encrypted ones.

Two ways it carries a request

An HTTP proxy speaks the web's own language, so it understands what it is being asked for and can act on it.

That understanding stops at the first encrypted site, and from there it carries bytes it cannot read.

1
A plain request
The whole address goes into the request line and the proxy fetches the page for you.
2
A tunnel for the rest
For an encrypted site the proxy is asked to open a pipe and then stops reading what goes through it.
3
A login in a header
The name and password travel in a header of their own, encoded for transport and protected by nothing.

One address covers every scheme

The browser is handed one proxy address on a single line, and that line applies to everything it opens.

A rule that maps only plain http to a proxy sends the encrypted traffic out direct, and today that is all of the traffic. When no usable rule can be built the launch is refused instead.

The prefix says how we reach the proxy

http, https or socks5 in front of the address names the protocol spoken to the proxy itself. It does not decide which of your traffic goes through it, because one address on one line already covers the lot.

TLS in front of the proxy

An entry may be written as https, and that means the hop between you and the proxy is itself encrypted.

That hop is what protects the login header, because a plain http proxy carries it readable to anyone standing on the way.

A line from a seller often carries no scheme at all, and a line like that is read as plain http. If what you bought is a proxy spoken to over TLS, the line has to say so.

Where the password lives

Every process running under your account can read a command line, and residential traffic is sold by the gigabyte.

So a small local proxy holds the password and the launch line carries a loopback address. It is raised only for an entry that has a login at all.

The password is stored once, on the library row, and a row is linked by as many profiles as you like. Changing it touches one place rather than fifty.

Often confused with

SOCKS5
Forwards connections without reading them. An HTTP proxy reads the request and can answer it, refuse it, or change it on the way.
A VPN
Carries everything the machine does, every window together. A proxy entry belongs to one profile.
A proxy set in the system
One setting shared by every browser and program on the machine, which is the thing separate profiles exist to avoid.

What this does not do

It does not encrypt your traffic. The tunnel is a pipe, and whatever secrecy is inside it belongs to the site rather than to the proxy.
It does not hide which site you are opening from whoever runs it. The host is named before the tunnel is built.
A pasted line with no scheme is read as plain http rather than refused. A scheme nobody recognises is refused, because a quiet downgrade would put you in the open believing otherwise.
It does not make an address respectable. A datacentre address is recognised for what it is whatever protocol carries it.

Check it

Each claim above is one place in the code and one stand.

One address covers every scheme, proved by running the rule rather than reading it: apps/desktop/test/proxy-covers-https.js
The tunnel and the plain request run against a real proxy that demands a login: apps/desktop/test/proxy-auth-bridge.js
A proxy with a login works on the shipping engine and the password stays off the command line: apps/desktop/test/прокси-с-паролем-живьём.js
One parser reads a pasted line for the app and for the account alike: packages/shared/src/proxy-line.js

Questions

Is an HTTP proxy enough for encrypted sites?: Yes, through the tunnel. What matters is that the rule covers every scheme rather than plain http alone.
Why is the password not in the launch line?: Because any program running as you can read that line, and because the engine refuses a password written there at all.
What does https in front of a proxy mean?: That the hop to the proxy is encrypted. The exit address and everything after it are unchanged.
Is an HTTP proxy slower than SOCKS5?: In practice the network decides that and not the protocol. Where the address physically sits, and how many people sit behind it, matters far more.
Can the proxy read what I send?: For an encrypted site, no more than the host name. For a plain http one, all of it.

Next to this

Set one up in a profile

The free plan gives two profiles, with no time limit and no card.

Download ARMANOS Set a proxy for a profile