Guide

How to use a SOCKS5 proxy with a username and password.

Chrome and the other Chromium browsers cannot send a username and password to a SOCKS5 proxy. The Chromium proxy documentation says it directly: no authentication methods are supported for SOCKSv5. Donut Browser logs in to the proxy for the browser, so a profile can use an authenticated SOCKS5 proxy with no extension and no IP allowlist. You need Donut Browser installed and the host, port, username and password from your proxy provider.

1. Add the proxy

1. Open Network in the sidebar (Cmd/Ctrl+Shift+N) and stay on the Proxies tab.
2. Click New proxy.
3. In Type, choose SOCKS5. It is in the group “First hop in the clear”.
4. Fill in the fields below, then click Add Proxy.

If you have the proxy as one line, such as socks5://user:[email protected]:1080, paste it into Host. The form reads the line and fills in every field.

When you type a username, the form shows “These credentials cross the network readable”. SOCKS5 does not encrypt the connection from your computer to the proxy, so a network on that path can read the username and password. If your provider offers HTTP over TLS, that type encrypts this first hop.

To add many proxies at once, use Import on the same tab. See How to create many profiles, each with its own proxy.

2. Check the proxy

Click the check button in the Status column of the proxy (tooltip “Check proxy validity”). Donut connects through the proxy the same way the browser will, and Connection details shows:

• the exit IP and its city and country,
• the ISP and the Timezone of the exit,
• whether the proxy relays UDP, under UDP,
• how long the check took, under Took.

Donut finds the location in a GeoLite2 database on your computer, so the exit IP is not sent to a lookup service. It reads the exit IP from public echo services such as api.ipify.org, through the proxy.

The UDP result matters for WebRTC and QUIC. Donut asks the SOCKS5 proxy for a UDP relay and waits up to 10 seconds. Yes means WebRTC can go through the proxy. HTTP, HTTPS and SOCKS4 proxies always show No, because those protocols cannot carry UDP.

3. Give the proxy to a profile

For a new profile, click New on the Profiles page (Cmd/Ctrl+N). In Create new profile, open the proxy picker, which reads “No proxy / VPN” until you choose one, and pick the proxy. Donut measures the proxy’s exit when it makes the profile, and sets the profile’s timezone and language to match that location.

For an existing profile, stop it first, then use one of these:

• the Proxy cell of the profile’s row in the table,
• the Network section of the profile panel (the info button on the row), field Proxy,
• for several profiles, select them and choose Assign proxy in the action bar.

A profile uses a proxy or a VPN, not both. Choosing a proxy removes the profile’s VPN.

If the proxy is in another country than the one the profile was made for, read How to match a browser’s timezone and language to its proxy before you launch.

4. Launch the profile and confirm the IP

Launch the profile and open these pages in it:

1. What is my IP should show the exit IP from step 2, not your own.
2. WebRTC leak test should show the exit IP or no address. It must not show your own IP.
3. DNS leak test shows which resolvers answer for the profile.

With a SOCKS5 proxy, the proxy resolves host names, so your own DNS server does not see the sites you open. If you set a DNS server in the profile’s Network section, Donut sends those queries through the proxy instead.

How Donut passes the password

Every Wayfern profile starts with a small Donut relay on 127.0.0.1. The browser connects to that relay as a SOCKS5 proxy without a password. The relay logs in to your proxy with the username and password (the RFC 1929 method) and carries the traffic. The browser, the pages and their scripts never see the credentials. The relay stops when its browser closes.

Add the proxy with the API

The local API can add the same proxy and assign it. Turn it on under Integrations (Cmd/Ctrl+I) → Local API → Enable local API server, and export the Authentication token as DONUT_API_KEY. Proxy routes work on every plan.

curl -sS -X POST http://127.0.0.1:10108/v1/proxies \
  -H "Authorization: Bearer $DONUT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "US SOCKS5",
    "proxy_settings": {
      "proxy_type": "socks5",
      "host": "proxy.example.com",
      "port": 1080,
      "username": "user",
      "password": "secret"
    }
  }'

const response = await fetch("http://127.0.0.1:10108/v1/proxies", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.DONUT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    name: "US SOCKS5",
    proxy_settings: {
      proxy_type: "socks5",
      host: "proxy.example.com",
      port: 1080,
      username: "user",
      password: "secret",
    },
  }),
});
const proxy = await response.json();
console.log(proxy.id);

import os, requests

response = requests.post(
    "http://127.0.0.1:10108/v1/proxies",
    headers={"Authorization": f"Bearer {os.environ['DONUT_API_KEY']}"},
    json={
        "name": "US SOCKS5",
        "proxy_settings": {
            "proxy_type": "socks5",
            "host": "proxy.example.com",
            "port": 1080,
            "username": "user",
            "password": "secret",
        },
    },
    timeout=10,
)
response.raise_for_status()
print(response.json()["id"])

Then assign it with PUT /v1/profiles/{id} and the body {"proxy_id": "<proxy id>"}. An empty string removes the proxy. The relay reads the proxy when the profile launches, so stop a running profile first. See Create a proxy and Update a profile in the API reference.

Troubleshooting

If UDP shows No, the provider does not relay UDP. In the default WebRTC mode, Automatic, sites then get no WebRTC address. See WebRTC.

Related

• Proxies, VPNs and DNS: every proxy type and setting.
• How to use VLESS, Trojan or Shadowsocks in one browser
• How to rotate a proxy’s IP with a change-IP link
• How to match a browser’s timezone and language to its proxy

Donut Browser is free, with unlimited local profiles, and each one can have its own proxy. Download it for macOS, Windows or Linux.

Last updated October 30, 2026.