We sell proxies at Geonode, which makes this the kind of article you should read sceptically. So here is our commercial position stated openly: the single most useful thing in this article costs you nothing and makes us no money — do not use free proxies, and use HTTPS for everything. Those two habits eliminate most of the real risk. Beyond them, the questions worth asking a paid provider are about logging and about how a residential pool was sourced, and they are questions you should put to us as readily as to anyone else. There is also a section on what proxies fail to protect you from, which is longer than the marketing in this industry would suggest.
What "Safe" Actually Means Here
Four separate questions get bundled into one word, and they have different answers.
Can the operator see my traffic? Partly, and it depends heavily on HTTPS. Can the operator identify me? Yes — you have an account and a payment record. Does using one expose my device to attack? Rarely with a reputable provider; measurably with free ones. Does it protect my privacy from websites? Much less than people assume.
Take them in turn.
What the Proxy Operator Can See
The operator is by definition in the middle of your connection. What that means in practice divides sharply by protocol.
Over plain HTTP, the operator sees everything: the full URL, headers, cookies, request bodies, response bodies. Anything you submit, including credentials, is readable and modifiable. This is not a vulnerability, it is how an HTTP proxy works.
Over HTTPS, your client issues a CONNECT and the proxy relays encrypted bytes without being able to read them. The operator sees the destination hostname, the timing, and the volume of data — meaningful metadata, but not content.
That difference is the single most important safety fact about proxies. Over HTTPS, the operator knows you visited a bank's website; over HTTP, they can read your session cookie.
Two caveats worth stating.
TLS interception is possible if you install their certificate. Some corporate proxies do this deliberately, which is a legitimate arrangement in a managed environment and a red flag anywhere else. A consumer proxy service asking you to install a root certificate is asking to read your encrypted traffic.
Metadata is not nothing. Hostnames, timing and volume reveal a great deal. An operator logging destinations has a browsing history, even without content.
Free Proxies Are a Different Category of Risk
This is where the evidence is unambiguous, and it is worth citing properly rather than asserting.
The 2024 study Free Proxies Unmasked, presented at the NDSS MADWeb workshop, analysed "over 640,600 proxies" from 11 providers over a 30-month period. Its findings:
Most do not work. Only "34.5% of proxies were active at least once during our tests."
Many are compromised machines. The researchers "identified 4,452 distinct vulnerabilities on the proxies' IP addresses", including "1,755 vulnerabilities that allow unauthorized remote code execution" and "2,036 that enable privilege escalation on the host device". They also noted that "42,206 of them appear to run on MikroTik routers" — consumer and small-business networking equipment, not proxy infrastructure.
Thousands actively tamper with traffic. The study found "16,923 proxies that manipulate content, indicating potential malicious intent by proxy owners."
The authors' conclusion is direct: "the use of free web proxies poses significant risks to users' privacy and security."
The economic logic behind those numbers is simple and worth internalising. Bandwidth costs money. A free proxy is funded somehow, and the available models are advertising injection, data collection and resale, credential harvesting, or — in the case of compromised routers — nobody funding it at all because the owner does not know it exists.
This is our clearest advice in the whole article and it costs you nothing: do not route anything you care about through a free public proxy. If your budget is genuinely zero, use your own connection.
The Real Risks, Ranked
For paid services, ordered by how likely each is to affect you.
1. Logging. The most probable and least dramatic. Most providers log something — connection metadata at minimum, often more, sometimes for legal reasons. The risk is not that this is sinister but that it exists, is retained, and can be requested or breached. Read the policy; treat "we do not log" without specifics as marketing.
2. Shared reputation. Other customers' behaviour affects the addresses you use. Not a safety issue for you, but it is the most common practical problem.
3. Content injection. Vanishingly rare among reputable paid providers and common among free ones. HTTPS prevents it for encrypted traffic.
4. Credential exposure. Only over plain HTTP or with an installed interception certificate. Both are avoidable.
5. Provider compromise. A breach at the provider exposes account details and whatever logs exist. Real, and mitigated by using a unique password and paying attention to what data you hand over.
6. Legal exposure through the pool. If a residential network was assembled without consent from the people carrying the traffic, that is a problem for the provider and potentially for its customers' continuity. Covered next.
How Residential Pools Are Sourced, and Why It Matters
The question most buyers never ask, and the one with the clearest recent evidence behind it.
Residential proxies route through ordinary consumer connections. The provider does not own those connections, so somebody has to agree. The legitimate model is compensation — applications or SDKs that pay users or give them something in exchange, with informed consent. The illegitimate model is bundling the capability into software people install for another reason, or running on devices whose owners have no idea.
This stopped being theoretical in January 2026. According to reporting on Google's action, on 28 January 2026 Google's Threat Intelligence Group took measures against the IPIDEA network: pursuing legal action against brand domains and control infrastructure, sharing technical intelligence about IPIDEA SDKs with platforms and law enforcement, and configuring Google Play Protect to warn users and remove apps containing IPIDEA components. The action reportedly affected over a dozen Hong Kong-incorporated brands including LunaProxy, ABCProxy, 360Proxy, 922Proxy, Cherry Proxy, IP2World, IPidea.io, PIA S5 Proxy, PyProxy and TabProxy — all reselling the same underlying network — and was expected to remove roughly nine million devices from it.
These are Google's documented allegations rather than our findings, and we present them as such: Google documented that the network facilitated the BADBOX 2.0, Kimwolf and Aisuru botnets, and that "over 550 threat groups have used IPIDEA's proxies directly to hide their malicious activities". An IPIDEA spokeswoman acknowledged the company had engaged in "relatively aggressive market expansion strategies" and "conducted promotional activities in inappropriate venues".
Two lessons for a buyer, independent of what one makes of the allegations.
Sourcing is a continuity risk, not only an ethical one. Customers of those brands lost their service.
Multiple brands can be one network. A market with many names is not necessarily a market with many suppliers, and diversifying across brands that share a supplier diversifies nothing.
So ask. How is the pool sourced, what does the consent flow look like, and can participants leave. A provider that answers specifically is telling you something; a provider that deflects is telling you something too.
What Proxies Do Not Protect You From
The section that matters most for anyone using one for privacy reasons.
Websites identifying you. Cookies, browser fingerprints, account logins and behavioural patterns all identify you regardless of routing. A proxy changes the address in the logs and nothing else about how tracking works.
Malware. A proxy relays traffic. It does not inspect it for threats. It is not a security control and buying one as a defence is a category error — a point we expanded on in proxy vs firewall.
Your own leaks. DNS queries going to your ISP's resolver, WebRTC exposing local addresses, IPv6 traffic bypassing an IPv4-only proxy, and applications not covered by your configuration. Each of these silently undoes the routing, and none of them announces itself. Our guide on testing proxies covers checking for them.
Anything you type. Names, addresses, payment details. A proxy does not anonymise a form submission.
Your ISP knowing you use a proxy. They see the connection to the proxy, just not what goes through it.
Legal process. Providers have jurisdictions, records and obligations. This is not the tool for evading lawful investigation and we would not sell it as one.
Safe Usage Habits That Actually Help
Concrete practices, roughly in order of how much risk each removes.
Use HTTPS for everything, and verify that you are. This single habit converts the operator from someone who can read your traffic into someone who can see where it went. Modern browsers make plain HTTP visible; in scripts, check that your requests use https:// and that certificate verification is on. Disabling certificate checks to "make the proxy work" undoes the protection entirely — if TLS fails through a proxy, find out why rather than silencing it.
Never install a provider's root certificate. In a managed corporate environment this may be a legitimate policy decision made by your employer. For a consumer or commercial proxy service it means handing over the ability to read your encrypted traffic, and there is no benign reason for a proxy vendor to need it.
Keep credentials out of URLs where you can. http://user:pass@proxy:9000 puts your password into shell history, process listings, verbose logs and any error report you paste into an issue tracker. Use environment variables or a configuration file with restricted permissions, and remember that curl's verbose output includes them.
Do not reuse passwords with proxy accounts. A breach at any provider should cost you exactly one credential.
Separate sensitive activity from proxied activity. Banking, health, and anything tied to your identity does not need to go through a third party's infrastructure. Route what needs routing and leave the rest alone — this is both safer and cheaper on metered bandwidth.
Test for leaks after any configuration change. DNS, WebRTC and IPv6 all bypass proxy settings under common conditions, and none of them warn you. A five-minute check after a change is worth more than an assumption held for a year.
Restrict what your proxy configuration covers. System-wide proxy settings route everything, including updaters and telemetry you never considered. Application-level configuration is narrower and easier to reason about.
And run your own if the trust question is the blocking one. For datacentre addresses, renting a server and running proxy software yourself removes the operator from the equation entirely — you are the operator. It costs setup time and gives you no residential characteristics, but if what worries you is a third party seeing your traffic, it is the complete answer.
How to Evaluate a Provider
Questions that separate a considered choice from a guess. Ask them of us too.
Is there a specific logging policy? What is retained, for how long, and under what circumstances is it disclosed. Vagueness is the answer.
How is the residential pool sourced? As above. This is the single highest-signal question in the whole industry.
Is the pricing plausible? Residential bandwidth has a real underlying cost — roughly $0.79 to $7.00 per gigabyte across the market. Far below that means either an explainable structural advantage or a sourcing practice best not examined.
Is there a real trial? Enough volume to test properly. A provider unwilling to let you evaluate is worth a second thought.
Is the company identifiable? A registered entity, a jurisdiction, a named team, a support channel that answers.
Do they promise things nobody can deliver? "Undetectable", "100% anonymous", "guaranteed". Anyone claiming these is either mistaken or hoping you are.
Do they ask you to install a certificate? For a consumer proxy service, this is a hard stop.
People Also Ask
Are proxies safe to use?
A reputable paid proxy carrying HTTPS traffic is a modest and manageable risk — the operator sees destinations and volumes but not content. A free public proxy is genuinely unsafe: research analysing over 640,600 of them found thousands actively manipulating content and thousands of exploitable vulnerabilities on the host machines.
Can a proxy see my passwords?
Over plain HTTP, yes — everything is readable. Over HTTPS, no, because the proxy relays encrypted bytes it cannot decrypt. The exception is if you have installed the provider's root certificate, which allows interception. Never do that for a consumer proxy service.
Are free proxies dangerous?
Yes. A 2024 peer-reviewed study of over 640,600 free proxies found only 34.5% ever functional, 16,923 manipulating content, and thousands of vulnerabilities on the host addresses including 1,755 permitting remote code execution. Many run on compromised consumer routers whose owners are unaware.
Do proxies make me anonymous?
No. They change the address a website records. Cookies, browser fingerprints, logins and behavioural patterns identify you regardless, and your provider knows exactly who you are because you have an account and a payment record. The accurate word is "different address", not "anonymous".
Is a proxy safer than a VPN?
Different, not safer. A VPN typically encrypts all traffic from your device and routes it through one operator; a proxy usually handles specific applications and, over HTTPS, cannot read your content anyway. Both require trusting the operator. The trust question is the same; the scope differs.
Can using a proxy get me hacked?
With a reputable paid provider, unlikely. With a free public proxy, the risk is real — operators can inject content into unencrypted traffic, and many free proxies run on already-compromised devices. HTTPS is what prevents content injection, which is another reason to use it everywhere.
What should I ask a proxy provider before buying?
What exactly is logged and for how long; how the residential pool is sourced and how participants consent; whether the pricing is plausible against the market; whether there is a trial large enough to test properly; and whether the company is identifiable. Treat any guarantee of undetectability as a reason for caution.
Are residential proxies safe to use?
The technical risk is the same as any proxy. The additional question is ethical and practical: whether the people whose connections carry your traffic agreed to it. Networks assembled without consent have been subject to enforcement action, and customers of those brands lost service — so sourcing is a continuity question as well as a moral one.
Wrapping Up
"Are proxies safe" resolves into a much more answerable question: who runs this one, and is my traffic encrypted.
If the answer is a reputable paid provider and yes, the residual risk is metadata — destinations, timing, volumes — and whatever they log. That is a real consideration and a manageable one, and it is the same consideration that applies to your ISP.
If the answer involves a free public proxy, the evidence is not ambiguous. Most do not work, thousands manipulate content, many run on machines whose owners do not know, and the funding model is necessarily something other than your wellbeing.
The two habits that eliminate most of the risk cost nothing: use HTTPS everywhere, and never install a provider's root certificate. After that, the question worth asking any vendor — us included — is how the residential pool was sourced. It is the one that predicts both the ethics and, as 2026 demonstrated, whether the service will still exist next quarter.