Proxy Browsers and Web Proxies: What They See

A free web proxy or proxy browser puts a stranger's server between you and every site you visit, and that server can see far more than most people expect. People use them to get past a school or office filter, to look as if they are in another country, to save mobile data or simply because a browser offered a free "VPN" button. This guide explains in plain English how the main kinds of proxy work, what the operator can and cannot see, where HTTPS protects you and where it does not, and how to choose something safer. It is written for everyday users, parents and the IT and security staff who field their questions. Organisations running their own forward or reverse proxies should read the Proxies and Forward vs Reverse Proxy Security Guide instead.

Key takeaways

Every proxy is a trusted middle party. The Tor Project describes an ordinary proxy as a "single point of trust and failure": one operator sees both who you are and where you go.
Proxy websites usually break HTTPS protection. When you type an address into a web proxy site, your secure connection ends at the proxy, so the operator can read pages, form entries and passwords in full.
Compression browsers read your pages by design. Opera states that in Opera Mini's Extreme savings mode no strict end-to-end encryption with the website is possible, because its servers need the unencrypted page to compress it.
HTTPS through a tunnelling proxy still hides content, not destinations. A proxy that only relays an encrypted connection sees which sites you visit and when, but not what is on the page, as long as you never accept certificate warnings.
Never log in to anything important through a free proxy. Banking, email, work and health accounts should only be used directly or over a provider you have chosen deliberately and can hold to account.

The kinds of proxy people actually meet

"Proxy" covers several very different things. The risk depends on which one you are using, so it is worth identifying it first.

Type	How you use it	How it works	Typical example
Web proxy site	Visit a site and type the address you want into a box	The proxy fetches the page itself and serves you a rewritten copy from its own domain	"Unblock" and "free proxy" websites
Proxy setting or tunnelling proxy	Enter a proxy address and port in browser or system settings	The browser asks the proxy to open a tunnel to each site; HTTPS sites stay encrypted end to end inside the tunnel	Free proxy lists, some extensions, school and office proxies
Built-in browser "VPN"	Toggle a switch in the browser	Browser traffic is sent encrypted to the provider's server and leaves from there	Opera's free browser VPN, which Opera says encrypts the connection from the browser to its VPN server
Compression or cloud browser	Use a browser in a data saving mode	The provider's servers load and shrink pages before sending them to your device	Opera Mini Extreme savings mode
Proxy extension	Install a browser add-on	Changes the browser's proxy settings; the extension itself may also read pages	Free "VPN" and "unblocker" extensions
Anonymity network	Use Tor Browser	Traffic passes through at least three relays, each adding a layer of encryption	Tor

A traditional VPN app differs mainly in scope: it usually routes all of the device's traffic, not just one browser, through the provider. The trust question is the same, and the Choosing a VPN Safely Guide covers how to assess a VPN provider. This page does not rank VPNs against proxies: both move trust from your network to an operator, and the details below decide which is acceptable for a given use.

Scope: what goes through it and what does not

Browser-only tools: a proxy setting, extension or browser VPN normally covers only that browser. Other apps on the same device, including email clients, messaging apps and operating system updates, keep using your normal connection.
Device-wide tools: the UK NCSC's VPN guidance makes the same point for VPNs: only traffic that is routed over the VPN is protected by it, and features such as split tunnelling or per-app VPNs can send data outside the tunnel.
Your own accounts still identify you: if you are signed in to a site, it knows who you are whatever your apparent location. A proxy changes the network address a site sees, not the cookies or account details your browser sends.
Downloads are not checked: a free proxy does not scan files for malware, and a web proxy site may itself change what you download.

What the operator can see

The table below assumes you visit an HTTPS site and do not click through any certificate warning. "Sees" means the operator could record it if it chose to; whether it does depends on its policy and honesty, which you usually cannot check.

Information	Web proxy site	Tunnelling proxy or browser VPN	Compression browser (extreme mode)	Tor (exit relay)
Your real IP address	Yes	Yes	Yes	No (only the first relay sees it, and it does not see the destination)
Which sites you visit	Yes, full addresses	Yes, the site names	Yes, full addresses	The destination, but not who you are
Page content	Yes	No, for HTTPS sites	Yes	No, for HTTPS sites
Passwords and form entries	Yes	No, for HTTPS sites	Yes	No, for HTTPS sites
Cookies and session tokens	Yes, and they may be stored on the proxy domain	No, for HTTPS sites	Yes	No, for HTTPS sites
Can alter pages or inject ads	Yes	Only on plain HTTP sites	Yes	Only on plain HTTP sites

Why web proxy sites see everything: your browser's padlock refers to the proxy's own domain. Your encrypted connection is to the proxy, and the proxy makes a separate connection to the real site, so everything is in the clear on the proxy's server. The Tor Project notes that a conventional proxy provider can in some cases read even encrypted traffic such as banking sessions.
Why tunnelling proxies see less: with an HTTP CONNECT tunnel the browser builds its encrypted connection directly with the real site, so the proxy only relays scrambled data. It still learns the site name and timing.
Why compression browsers see content: Opera's FAQ says traffic between the device and its servers is encrypted for secure pages, but compression must have access to the unencrypted page, so no strict end-to-end encryption with the website is possible in Extreme mode.
What hiding your location does not do: Opera's own help notes that hiding your location with its VPN does not stop sites tracking you through cookies they have already set.

Where HTTPS helps and where it stops

HTTPS encrypts the connection between your browser and the server you are connected to. Mozilla explains that without it, data can be viewed, stolen or altered in transit, which is why its HTTPS-Only Mode refuses to load sites that have no secure version unless you choose to continue. HTTPS protects you through a proxy only when the encrypted connection runs all the way to the real website.

Protected: page content, passwords, card numbers and cookies on HTTPS sites, when the proxy merely tunnels traffic.
Not protected: anything on a web proxy site or a compression browser in a server-side mode, because the encryption ends at the operator.
Not protected: which sites you visit. During the TLS handshake the browser normally sends the name of the site in clear. Mozilla's documentation on Encrypted Client Hello (ECH) says ECH hides that name, but only when DNS over HTTPS is enabled, and Firefox does not use ECH when a transparent proxy or certain enterprise or family safety settings are in place.
Warnings matter: a certificate warning while using a proxy can mean the proxy is trying to intercept your encrypted traffic. Close the page rather than clicking through.
Plain HTTP sites: anything not on HTTPS can be read and changed by any proxy. Turning on HTTPS-Only or HTTPS-First mode in your browser removes most of that risk.

Real risks of free proxies

Running proxy servers costs money. A free service is paid for somehow, and some business models put users at risk.

Data collection: browsing histories are valuable for advertising and profiling. A proxy that sees full addresses can build a very detailed picture of you.
Ad and script injection: a web proxy rewrites every page, so it can insert advertising or malicious scripts into otherwise trustworthy sites.
Credential theft: anything typed through a web proxy site, including email and bank passwords, passes through the operator in readable form. Attackers also build fake "proxy" sites for exactly this purpose.
Your connection used by others: some free apps and devices turn your home connection into an exit point for other people's traffic. The FBI warned in June 2025 that the BADBOX 2.0 botnet adds infected home devices to residential proxy services, often after users install "free" streaming apps from unofficial marketplaces. See the Residential Proxy Networks and Abuse Guide.
Extensions with full access: a proxy or "unblocker" extension often asks for permission to read and change data on all websites, which goes well beyond changing a proxy setting. See the Browser Extension Security Guide.
Breaking rules you agreed to: bypassing a school or employer filter can breach the acceptable use policy and may disable protections such as malware blocking that the filter provided.

Choosing safely: decision guide

What you want	Reasonable choice	Avoid
Read a public news article blocked in your region	A tunnelling proxy or browser VPN from a provider with a published privacy policy, HTTPS sites only, no logging in	Entering passwords through any free proxy
Use public Wi-Fi safely	HTTPS-Only mode on, or a VPN you have chosen deliberately	Web proxy sites, which add a stranger without adding protection
Save mobile data	Browser data saving modes that do not process pages on the provider's servers, or Wi-Fi when available	Server-side compression for banking, email or health sites
Strong privacy from network observers and from the operator	Tor Browser, with HTTPS sites	Single-operator free proxies claiming to make you anonymous
Get around a work or school filter	Ask the IT team to unblock a legitimate site	Any proxy, which may breach policy and remove protections
Access your bank, email or work account	A direct connection, or your organisation's own VPN	Every free proxy, extension or web proxy site

Check who runs it: a named company, a registered address, a privacy policy that states what is logged and for how long, and a way to contact them. Anonymous operators should be treated as untrusted.
Check where it comes from: install browsers, apps and extensions only from the official store or the developer's own site.
Check the permissions: refuse extensions that ask to read all site data unless that is plainly required.

How to use a proxy more safely, step by step

Turn on HTTPS-Only or HTTPS-First mode in your browser before using any proxy. In Firefox it is under Settings, Privacy and security.
Identify the type using the first table. If you are typing addresses into a website, it is a web proxy site: use it only for public pages.
Use a separate browser profile or private window for proxy browsing so that your logged-in sessions and saved passwords are not exposed.
Never sign in to important accounts through the proxy, and never accept a certificate warning.
Turn it off when finished. Proxy settings and extensions stay active until removed; check your browser or system network settings afterwards.
Undo it fully if in doubt: remove the extension or app, reset proxy settings to "no proxy" or "use system settings", and change any password you typed while it was active. Turn on multi-factor authentication for those accounts.

For IT and security teams

Staff and students reach for proxies when a filter blocks something they need. The defensive aim is to remove the need, then detect the rest.

Policy: state in the acceptable use policy that personal proxies, unblockers and browser VPNs are not allowed on managed devices, and give a fast route to request an unblock.
Browser management: use enterprise browser policies to lock proxy settings and to allow-list extensions. See the Browser Security Hardening Guide.
Detection: web filters and DNS logs can flag known proxy and anonymiser categories, and long-lived connections to a single unknown host carrying all browsing. MITRE ATT&CK tracks attacker use of proxies as T1090 Proxy, and interception by a malicious middle party as T1557 Adversary-in-the-Middle; see the T1090 Proxy Defensive Guide.
Identity angle: a password typed through a web proxy site should be treated as exposed. Make that a reportable event and reset the credential, and enforce phishing-resistant MFA so a captured password alone is not enough.

Signs that controls are working

Unblock request turnaround: median time to answer a legitimate unblock request (shorter times reduce proxy use).
Proxy category hits: number of managed devices reaching proxy or anonymiser categories per month, trending down.
Unmanaged extensions: count of devices with proxy or VPN extensions not on the allow-list.
Exposed credential resets: resets completed within 24 hours of a reported proxy login.

Framework mapping

Concern	NIST CSF 2.0	NIST SP 800-53 Rev 5	Other
Encryption in transit	PR.DS-02	SC-8	HTTPS-Only or HTTPS-First browser modes
Allowed software and extensions	PR.PS-05	CM-7	CIS Controls v8.1 Control 9 Email and Web Browser Protections
Monitoring unusual network use	DE.CM-01	SI-4	ATT&CK T1090 Proxy
Middle-party interception	PR.DS-02	SC-23	ATT&CK T1557 Adversary-in-the-Middle
User awareness	PR.AT-01	AT-2	Acceptable use policy

Common failure patterns

Logging in through a web proxy site: the password passes through the operator in readable form, and the session may stay usable by them.
Assuming the padlock means safety: on a web proxy site the padlock belongs to the proxy, not the bank or email provider.
Leaving data saving modes on for sensitive sites: server-side compression processes everything, including account pages.
Installing a "free VPN" extension with full site access: the extension can read every page even if the proxy itself only tunnels.
Using free streaming apps or devices from unofficial stores: they can turn the home connection into someone else's proxy, as the FBI's BADBOX 2.0 warning describes.
Forgetting the setting is still on: weeks later, all browsing is still going through a stranger's server.

Practitioner checklist

Identify which kind of proxy is in use before judging the risk.
Turn on HTTPS-Only or HTTPS-First mode in every browser.
Never sign in to banking, email, work or health accounts through a free proxy or web proxy site.
Never click through a certificate warning while a proxy is active.
Use a separate browser profile for proxy browsing and remove the proxy when finished.
Install browsers, apps and extensions only from official stores, and check their permissions.
Reset and protect with MFA any password typed through an untrusted proxy.
For organisations: lock proxy settings, allow-list extensions, monitor proxy categories and offer a fast unblock route.

Proxy browsers and web proxies: what the operator sees and safer choices