KovraSOCKS5 is the proxy people actually use. It is protocol-agnostic, supports UDP, handles authentication, and appears as a paid add-on in several mainstream VPN subscriptions. It is also routinely described as a lightweight VPN, which it is not: it lacks the one property that defines a VPN. Here is the accurate version.
What SOCKS5 does
SOCKS operates at the session layer. Your application says "open a connection to this host and port", and the proxy opens it and shuttles bytes in both directions. Version 5 added three things that made it the default: UDP support (so it works for BitTorrent peer traffic, DNS, games and voice), authentication, and IPv6 support.
What it never added is encryption. There is no cipher negotiation in the protocol at all. When people call SOCKS5 "secure", they usually mean the site they visited was HTTPS — which would have been true without the proxy.
The comparison that matters
| SOCKS5 proxy | VPN | |
|---|---|---|
| Encryption | None | Full tunnel |
| Coverage | Per application, manually configured | Whole device via routing table |
| UDP | Yes | Yes |
| DNS | Depends on the client; often leaks locally | Resolved inside the tunnel |
| Failure behaviour | Falls back to direct connection silently | Kill switch blocks traffic |
| Overhead | Near zero | Low single-digit percent |
| Blocked by DPI | Easily, by port and handshake | Depends on protocol; camouflaged ones survive |
The leak that catches most users
Two failure modes account for nearly every "my SOCKS5 proxy exposed me" story.
Silent fallback. When a proxy becomes unreachable, many clients simply retry directly. There is no alarm, no disconnection, no visible change — the transfer keeps going from your real address. Torrent clients are the classic case: the proxy setting lives in the network preferences and nothing enforces it. A VPN kill switch is the opposite design: no tunnel, no packets.
DNS resolution outside the proxy. Unless the application explicitly sends hostname lookups through the proxy (SOCKS5 supports it; not every client uses it), your system resolver does the lookup. Your provider then holds a list of every domain you visited, in order, with timestamps — the exact metadata people use a proxy to avoid. Run the checks in the leak test guide before trusting any per-app configuration.
When SOCKS5 is the better choice
- One app needs a different exit IP while everything else stays local — testing, region checks, account separation.
- Latency is the entire point and the traffic is not sensitive.
- Inside a VPN tunnel, to add a second exit hop without a second full tunnel.
- On a network you already trust, where hiding hostnames from the operator is not a goal.
When it is the wrong tool
- Public Wi-Fi. The threat is the local network, and SOCKS5 does not protect against it. See public Wi-Fi security.
- Censored networks. A SOCKS5 handshake on a non-standard port is trivially fingerprinted and dropped. What survives is covered in Shadowsocks versus VLESS Reality.
- Anything where a silent failure is unacceptable — which includes torrenting, despite SOCKS5 being popular there.
- Free proxies from public lists. Unencrypted plus unaccountable is the worst combination available; the details are in free proxy lists.
The honest summary
SOCKS5 is a good router and a bad bodyguard. It changes where your traffic appears to come from, quickly and cheaply, for one program at a time. It does not hide what you are doing from anyone between you and the proxy, and it does not fail safely. Use it for what it is, and use a VPN for the rest.