---
title: "How to use a SOCKS5 proxy with a username and password"
description: "Chrome cannot log in to a SOCKS5 proxy. Add an authenticated SOCKS5 proxy to a Donut Browser profile, check it, and confirm the browser uses its IP."
url: "https://donutbrowser.com/docs/guides/socks5-proxy-with-password/"
---

# How to use a SOCKS5 proxy with a username and password

Chrome and the other Chromium browsers cannot send a username and password to a SOCKS5 proxy. The [Chromium proxy documentation](https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md) says it directly: no authentication methods are supported for SOCKSv5. Donut Browser logs in to the proxy for the browser, so a profile can use an authenticated SOCKS5 proxy with no extension and no IP allowlist. You need Donut Browser [installed](https://donutbrowser.com/docs/install) and the host, port, username and password from your proxy provider.

## 1. Add the proxy

1. Open **Network** in the sidebar (**Cmd/Ctrl+Shift+N**) and stay on the **Proxies** tab.
2. Click **New proxy**.
3. In **Type**, choose **SOCKS5**. It is in the group "First hop in the clear".
4. Fill in the fields below, then click **Add Proxy**.

| Field | What to enter |
| --- | --- |
| Name | Any name. It must be unique among your proxies. |
| Host | The proxy's host name or IP address, for example `proxy.example.com` |
| Port | 1 to 65535, for example `1080` |
| Username | The username exactly as your provider gives it, with any session or country part |
| Password | The proxy password |
| Change IP link | Optional. See [How to rotate a proxy's IP](https://donutbrowser.com/docs/guides/rotate-proxy-ip). |

If you have the proxy as one line, such as `socks5://user:pass@proxy.example.com:1080`, paste it into **Host**. The form reads the line and fills in every field.

When you type a username, the form shows "These credentials cross the network readable". SOCKS5 does not encrypt the connection from your computer to the proxy, so a network on that path can read the username and password. If your provider offers HTTP over TLS, that type encrypts this first hop.

To add many proxies at once, use **Import** on the same tab. See [How to create many profiles, each with its own proxy](https://donutbrowser.com/docs/guides/bulk-create-profiles).

## 2. Check the proxy

Click the check button in the **Status** column of the proxy (tooltip "Check proxy validity"). Donut connects through the proxy the same way the browser will, and **Connection details** shows:

- the exit IP and its city and country,
- the **ISP** and the **Timezone** of the exit,
- whether the proxy relays UDP, under **UDP**,
- how long the check took, under **Took**.

Donut finds the location in a GeoLite2 database on your computer, so the exit IP is not sent to a lookup service. It reads the exit IP from public echo services such as `api.ipify.org`, through the proxy.

The UDP result matters for WebRTC and QUIC. Donut asks the SOCKS5 proxy for a UDP relay and waits up to 10 seconds. **Yes** means WebRTC can go through the proxy. HTTP, HTTPS and SOCKS4 proxies always show **No**, because those protocols cannot carry UDP.

## 3. Give the proxy to a profile

For a new profile, click **New** on the **Profiles** page (**Cmd/Ctrl+N**). In **Create new profile**, open the proxy picker, which reads "No proxy / VPN" until you choose one, and pick the proxy. Donut measures the proxy's exit when it makes the profile, and sets the profile's timezone and language to match that location.

For an existing profile, stop it first, then use one of these:

- the **Proxy** cell of the profile's row in the table,
- the **Network** section of the profile panel (the info button on the row), field **Proxy**,
- for several profiles, select them and choose **Assign proxy** in the action bar.

A profile uses a proxy or a VPN, not both. Choosing a proxy removes the profile's VPN.

If the proxy is in another country than the one the profile was made for, read [How to match a browser's timezone and language to its proxy](https://donutbrowser.com/docs/guides/match-timezone-to-proxy) before you launch.

## 4. Launch the profile and confirm the IP

Launch the profile and open these pages in it:

1. [What is my IP](https://donutbrowser.com/tools/what-is-my-ip) should show the exit IP from step 2, not your own.
2. [WebRTC leak test](https://donutbrowser.com/tools/webrtc-leak-test) should show the exit IP or no address. It must not show your own IP.
3. [DNS leak test](https://donutbrowser.com/tools/dns-leak-test) shows which resolvers answer for the profile.

With a SOCKS5 proxy, the proxy resolves host names, so your own DNS server does not see the sites you open. If you set a **DNS** server in the profile's **Network** section, Donut sends those queries through the proxy instead.

## How Donut passes the password

Every Wayfern profile starts with a small Donut relay on `127.0.0.1`. The browser connects to that relay as a SOCKS5 proxy without a password. The relay logs in to your proxy with the username and password (the RFC 1929 method) and carries the traffic. The browser, the pages and their scripts never see the credentials. The relay stops when its browser closes.

## Add the proxy with the API

The [local API](https://donutbrowser.com/docs/quickstart) can add the same proxy and assign it. Turn it on under **Integrations** (**Cmd/Ctrl+I**) → **Local API** → **Enable local API server**, and export the **Authentication token** as `DONUT_API_KEY`. Proxy routes work on every plan.

```bash
curl -sS -X POST http://127.0.0.1:10108/v1/proxies \
  -H "Authorization: Bearer $DONUT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "US SOCKS5",
    "proxy_settings": {
      "proxy_type": "socks5",
      "host": "proxy.example.com",
      "port": 1080,
      "username": "user",
      "password": "secret"
    }
  }'
```

```javascript
const response = await fetch("http://127.0.0.1:10108/v1/proxies", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.DONUT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    name: "US SOCKS5",
    proxy_settings: {
      proxy_type: "socks5",
      host: "proxy.example.com",
      port: 1080,
      username: "user",
      password: "secret",
    },
  }),
});
const proxy = await response.json();
console.log(proxy.id);
```

```python
import os, requests

response = requests.post(
    "http://127.0.0.1:10108/v1/proxies",
    headers={"Authorization": f"Bearer {os.environ['DONUT_API_KEY']}"},
    json={
        "name": "US SOCKS5",
        "proxy_settings": {
            "proxy_type": "socks5",
            "host": "proxy.example.com",
            "port": 1080,
            "username": "user",
            "password": "secret",
        },
    },
    timeout=10,
)
response.raise_for_status()
print(response.json()["id"])
```

Then assign it with `PUT /v1/profiles/{id}` and the body `{"proxy_id": "<proxy id>"}`. An empty string removes the proxy. The relay reads the proxy when the profile launches, so stop a running profile first. See [Create a proxy](https://donutbrowser.com/docs/rest-api#create-proxy) and [Update a profile](https://donutbrowser.com/docs/rest-api#update-profile) in the API reference.

## Troubleshooting

| Message | What to do |
| --- | --- |
| "Proxy authentication failed for host:port. Check your username and password." | The proxy refused the login. Copy the username and password again from your provider. |
| "Connection refused by host:port. The proxy server is not accepting connections." | The port is wrong, or the proxy is down. Make sure you use the provider's SOCKS5 port. |
| "Connection to host:port timed out. The proxy server is not responding." | The host does not answer. Check the host and port, and any firewall on your network. |
| "Could not resolve proxy host 'host'. Check that the hostname is correct." | The host name has a typo, or it does not exist. |
| "SOCKS proxy host:port could not reach the target. The proxy server may not have internet access." | The login worked, but the proxy cannot reach the internet. Ask your provider. |
| "The selected proxy isn't working, so the profile wasn't created." | Donut checks the proxy before it makes a profile. Fix the proxy, or create the profile without it. |
| "Proxy does not respond" before a launch, with "The proxy refused the username or password." | Donut tests the route for up to 4 seconds before a launch. Fix the login, or click **Launch anyway**. |

If **UDP** shows **No**, the provider does not relay UDP. In the default WebRTC mode, **Automatic**, sites then get no WebRTC address. See [WebRTC](https://donutbrowser.com/docs/profiles#webrtc).

## Related

- [Proxies, VPNs and DNS](https://donutbrowser.com/docs/proxies): every proxy type and setting.
- [How to use VLESS, Trojan or Shadowsocks in one browser](https://donutbrowser.com/docs/guides/vless-trojan-shadowsocks)
- [How to rotate a proxy's IP with a change-IP link](https://donutbrowser.com/docs/guides/rotate-proxy-ip)
- [How to match a browser's timezone and language to its proxy](https://donutbrowser.com/docs/guides/match-timezone-to-proxy)

Donut Browser is free, with unlimited local profiles, and each one can have its own proxy. [Download it](https://donutbrowser.com/) for macOS, Windows or Linux.