VPN vs Proxy: A VPN Covers the Whole Device, Not One Program
You enter a proxy in the settings of one program. A VPN connects your whole phone or computer at once. Most of the other differences between them follow from this one. The VPN vs proxy comparison below covers café Wi-Fi, the sites you visit and speed. At the end, answer 3 questions to choose between them.
You enter a proxy in each program and set exceptions for a VPN
A proxy is the address and port of someone else’s server. You enter them in a browser, in Telegram or in the network settings of your system. Only programs that read those settings send their traffic through the proxy. For example, you enter a proxy in Telegram on your laptop. From then on, Telegram traffic goes through that server. Your browser, Steam and system updates still use your own connection and your own IP address.
For a VPN, you do not enter a server address anywhere. The app installs a VPN adapter, a virtual network card, in the system. On a computer, this step may require administrator rights. While the VPN is on, all traffic goes through that adapter. This includes games and system services that never read proxy settings. Ben's VPN describes its “Off” split tunneling mode the same way. The text in the app reads: “In this mode, all device traffic goes through the VPN”.
With a proxy, you enter it in each program separately. A program you forget connects directly, without the proxy. With a VPN, every program goes through the server, and you choose the exceptions. In Ben's VPN, you set them with the “Tunnel” tile on the main screen. In “Manual” mode, you list the domains, IP addresses and subnets that do not need the VPN. On Android, there is also a list of “Apps that bypass the VPN”.
Proxy types differ in where they work and what they encrypt
The table compares 4 proxy types and a “VPN” browser extension with a VPN app.
| What it is | Where you enable it | Encrypts the connection to the server | What goes through it |
|---|---|---|---|
| HTTP proxy | In a browser, in system settings or in a Wi-Fi network’s settings | No | Web requests from programs that read those settings |
| HTTPS proxy | Usually in a browser or one of its extensions | Yes, up to the proxy itself | Browser traffic |
| SOCKS5 | In Telegram, a browser, a torrent client and other programs with that setting | No | That program’s connections, and UDP if both sides support it |
| MTProto proxy | Only in Telegram | Telegram data is already encrypted by Telegram’s own protocol | Telegram only |
| “VPN” browser extension | One browser | Depends on the service | That browser’s tabs |
| VPN app | The whole device | Usually, yes | Every program at once, except what you exclude |
Browser extensions cannot reroute traffic from other programs. Of all network settings, an extension can change only the browser’s proxy. So a “VPN” extension works as a proxy for the tabs of one browser. Ben's VPN does not have a browser extension. The VPN handles the browser like any other program, so its tabs go through the server too. The only exceptions are sites you exclude from the VPN. More detail is on our page about browser extensions.
You cannot tell a proxy from a VPN by the protocol name either. Shadowsocks, for example, was designed as an encrypted proxy. Jigsaw later built Outline on Shadowsocks, and Ben's VPN is based on Outline. Our app is still a VPN, because every program on the system goes through it. Of its 4 protocols (VLESS + REALITY, XHTTP, Hysteria2 and Shadowsocks), the app selects one automatically. There is no protocol choice in the app settings.
An unencrypted proxy reveals site names and the password to the network
With a regular HTTP proxy on café Wi-Fi, site names go over the network in plain text. Before each connection, the browser sends the proxy a CONNECT request with the site name. The content of HTTPS sites stays encrypted, even through the proxy. The hotspot owner and your internet provider can read the CONNECT requests. So they can see the list of sites you visit. Pages without HTTPS are sent with no encryption at all. The proxy can read these pages and even change them.
The username and password for the proxy are not encrypted either. An HTTP proxy usually receives them in Base64 under the Basic scheme. A SOCKS5 proxy receives them as plain text. Anyone who watches traffic on that network can read them.
With a VPN, there are no CONNECT requests on café Wi-Fi. One encrypted connection goes from your device to the server. Even the DNS lookups that your device uses to find sites go inside it. The hotspot owner and your internet provider see only the server’s IP address and a byte count. The VPN server can now see the list of sites you visit. Before, the proxy could see the same list. When you choose a VPN service, you choose who gets that list.
Some proxies send your real IP address to the site
With a proxy and with a VPN, the site gets the server’s IP address instead of yours. The site then places you where the server is. Some proxies add your real IP address to requests for pages without HTTPS. They put it in an X-Forwarded-For or Forwarded header. With such a header, the site learns your IP address as if there were no proxy. A VPN works lower, at the level of network packets, and adds no headers.
Neither a proxy nor a VPN hides your account, browser language or time zone. If you are signed in, the service recognizes you by your account. Your browser sends its language to every site. Scripts on the page can read the time zone of your device. So a site can spot a “visitor from Japan” whose device uses New York time. Our guide to VPN basics lists what else a VPN does not change.
Distance, server load and background tasks lower the speed
Any intermediary adds one more hop between you and the site. A proxy and a VPN server in the same city add a hop of the same length. The speed then depends on the distance to the server and on its load. A free proxy from a public list serves everyone who found that list. Each of them gets a small share of its bandwidth.
Encryption itself has little effect on VPN speed. Processors have had dedicated instructions for AES encryption for years. Intel introduced them in 2010, and the first phones with them were released in 2013.
Since the VPN carries all device traffic, background tasks go through it too. Examples include Steam updates and photo uploads to the cloud. If such a task does not need the VPN and takes bandwidth, exclude it with the “Tunnel” tile. For speed, choose a location close to you. The “Fastest” tile in the “Change Location” window picks one near you.
3 questions to choose between a proxy and a VPN
A proxy is enough if you answer “no” to all 3 questions below. With one “yes” or more, a VPN is the more convenient choice.
- Does more than one program need to go through the server? A proxy in Telegram works for Telegram only. Your browser and games may need a new IP address too. Entering the proxy in each of them takes longer than connecting to a VPN. Some programs have no proxy setting at all. Our VPN for Telegram page covers Telegram in more detail.
- Are you on someone else’s network? In a café, hotel or airport, the network sees which sites you visit through a regular proxy. The same network can also read your proxy password. A VPN sends all traffic through one encrypted connection.
- Will you make calls, play games or use programs with no proxy settings? An HTTP proxy usually does not carry calls and online games. Their voice and game data mostly go over UDP. The CONNECT request described above opens only TCP connections. Such traffic either fails or bypasses the proxy. A VPN carries it with all other traffic, except what you exclude.
A game console, a smart speaker or a TV that cannot run the app is a special case. For these devices, there is a VPN on your router. It covers your whole home network at once.
To install Ben's VPN on your phone, computer or TV, open VPN for your devices.
Questions and answers
What is a reverse proxy, and does it hide me?
No, a reverse proxy works on the side of the site, not on your side. It accepts requests for the site’s server and forwards them to that server. Content delivery networks and load balancers work this way. A reverse proxy hides the site’s server and reduces its load. It sees your IP address, as any site does. The HTTP standard calls this kind of intermediary a gateway.
Does multihop work like a proxy chain?
The idea is similar, since traffic passes through 2 servers in both cases. A proxy chain is usually built for one program. Multihop in Ben's VPN covers the whole VPN connection. It adds an intermediate server in a third country to the route. We recommend the “Automatic” mode. In it, the app adds that server when your connection needs it to stay stable. You can find the setting under “Account” → “Settings” → “Multihop”.
How can I tell whether a proxy or a VPN is working right now?
Open an IP-checking site in the browser with the proxy and in a second browser without it. If the proxy is entered in one program only, the IP addresses will not match. With a VPN, both browsers show the same IP address in the country of your location. The main screen of Ben's VPN also shows “Connected to” and an IP address. The only exception is an IP-checking site that you exclude from the VPN.
Can a proxy read HTTPS sites?
No, on its own a proxy sees only the name of an HTTPS site. To read HTTPS traffic, an intermediary needs its root certificate installed on your device. Some companies inspect traffic on their networks this way. If a free proxy or an unfamiliar program asks you to install a certificate, do not install it.
Can a VPN be unencrypted?
Yes, the term “VPN” means a private network over a public one, not encryption. For example, L2TP does not encrypt data by itself. That is why L2TP is usually paired with IPsec. In Ben's VPN, the connection to the server is always encrypted, whichever protocol the app uses.
