Explainer
Free vs paid proxies: what free really costs you
Most free proxy lists don't work, and some tamper with traffic. What three studies found, which free tiers are legit, and when paying is worth it.
Unless you’re just poking at a practice site, pay for your proxy. Three peer-reviewed studies of free proxy lists found that most listed proxies don’t work on a given day, and that a measurable share of the ones that do change the pages they hand back to you.
The good news is how little “paid” costs: a few dollars buys a datacenter plan, and a couple of companies offer small free tiers that have nothing in common with a public list. Below is what the research measured, which free options are fine, today’s entry prices (verified November 12, 2026), and what I’d pick for your job.
Short on time?
Here's my take
- Learning, or scraping a practice site
- No proxy, or Webshare's free tier
- You may not need a proxy at all. If you do, Webshare gives 10 shared datacenter proxies and 1 GB a month for free, and its pricing page says no card is needed.
- Anything with a login, payment or personal data
- Paid only, never a public list
- In a 2018 study, 5.15% of working open proxies served malicious or unwanted content. In another, 66% added a header that gave away the user's real IP.
- A small scraping job on a budget
- Webshare's $2.99 datacenter plan
- 100 datacenter proxies for $2.99 a month. If the site blocks datacenter IPs, DataImpulse residential at $1/GB with no subscription.
- You want the data, not the IPs
- A scraping-API free tier
- ZenRows, for example, gives 5,000 credits a month with no card, and the API deals with proxies for you.
- Private browsing
- A paid VPN, not a proxy list
- A VPN encrypts your whole device's traffic to a company you can identify. A free list puts an unknown machine in the middle.
Prices verified . Sponsors cannot buy a verdict or a position.
This page sits in the proxies hub. It doesn’t rank providers; for that, see the cheapest residential proxies I priced.
Free list, free tier or paid: how do they compare? #
The middle column is the one most comparison pages skip. A vendor’s free tier is still a shared datacenter proxy, but it’s run by a company you can identify, under terms you can read.
| Question | Public free list | Vendor free tier | Paid plan |
|---|---|---|---|
| What it is | Open proxies collected from the web and posted on aggregator sites | A small allowance from a proxy company, such as Webshare's 10 datacenter proxies | Proxies you rent by the IP or by the GB |
| Who runs it | Usually unknown; often misconfigured or compromised machines (2024 study) | The vendor | The vendor |
| Working on a given day | 3.36% of listed proxies on an average day (2021–23 study) | No independent data found | No independent data found |
| HTTPS | Not guaranteed; two studies disagree on how common it is | If the proxy supports CONNECT, HTTPS sites stay encrypted end to end | Same as the free tier |
| Can it change your pages? | 38% of working proxies did in a 2018 study; 5.15% of working proxies maliciously | No independent tampering study found | No independent tampering study found |
| Where the IPs come from | Unknown | Datacenter servers | Datacenter, or household connections for residential (ask how they were sourced) |
| Who answers if it breaks | Nobody | The vendor, under its terms | The vendor, under its terms |
| Cost | $0 | $0 (Webshare: no card required) | From $2.99/month for 100 datacenter proxies, or $1/GB residential |
| Good for | Not much beyond curiosity | Learning and light tests on practice sites | Real jobs, and anything with a login |
Source: Mehanna et al. 2024, Mani et al. 2018, Tsirantonakis et al. 2018, RFC 9110, Webshare and DataImpulse pricing pages. Prices verified 12 Nov 2026. Scroll sideways for more columns.
Where do free proxies come from? #
Mostly from machines that were never meant to be public proxies. The largest study found MikroTik-related software on 42,206 of the proxy IPs, said common URLs in altered pages were “hinting at misconfigured MikroTik routers”, and traced much of the altered content to misconfigured cloud servers at hosts such as Tencent and DigitalOcean (Mehanna et al., §IV-B).
The authors are careful about intent. They say most content changes came from misconfiguration “rather than malicious intent”, while concluding that many free proxies “likely result from compromised devices rather than intentional deployments” (Mehanna et al., §IV-B and §VI). The 2018 Mani paper likewise puts some open proxies down to misconfiguration or compromise, while noting that many are run by choice (Mani et al.).
So when you paste an IP from a list, you’re usually borrowing a stranger’s badly set-up router or a forgotten cloud server. In most cases there’s no one you could hold responsible for what happens to your traffic.
How many of them actually work? #
Very few on any given day. Over 50 days in April and May 2018, Mani et al. found that “more than 92%” of the open proxies advertised on aggregator sites were offline or otherwise unavailable, with a median of 3,283 answering each day (Mani et al., §5).
Mehanna et al. checked 640,693 proxies from 11 free lists once a day from April 2021 to October 2023. Only 221,319 (34.5%) ever passed a test, and on an average daily run just 3.36% of the listed proxies were working (Mehanna et al., §IV).
The ones that work don’t all die within hours, as some pages say. Almost half of the ever-active proxies in that study stayed up six days or more, though a once-a-day test can’t see what happens within a day (§IV-A).
| Study | When measured | Proxies | Key numbers | Limits |
|---|---|---|---|---|
| Tsirantonakis et al., NDSS 2018 | Mid April – mid June 2017, published February 2018 | 65,871 HTTP proxies from 15 free lists and 1 paid list | 19,473 worked properly; 38.21% of those altered content; 5.15% of those (1,004) were malicious or unwanted | HTTP only |
| Mani et al., 2018 (arXiv version) | April 12 – May 31, 2018 | 107,034 from 6 aggregator lists and a proxy-finding tool | Over 92% offline; 2.2% of HTML requests got malicious content (one-day sample); 413 of 21,385 proxies (1.93%) tampered with a downloaded .exe | Daily tests; draft version, final paper not read |
| Mehanna et al., MADWeb 2024 | April 2021 – October 2023 | 640,693 from 11 lists | 34.5% ever worked; 3.36% working on an average day; 16,923 altered content at least once; 2.5% answered on HTTPS | Tested once a day; Shodan snapshot taken once |
Speed is the number I’d most like to give you, and I can’t do it fairly. The only study figure is Mani et al.’s average of 128.5 KiB per second on 1 MiB downloads in 2018 (§5.1). I found no study that measures paid proxies the same way, and the latency numbers on other pages name no method, so I leave them out.
What can a free proxy do to your traffic? #
Read it, change it, and tell the website who you are. These are measured outcomes, not what-ifs.
In the NDSS study, 7,441 of the 19,473 working proxies (38.21%) changed the content they relayed.
Most changes were harmless, often privacy proxies stripping ads and trackers, but 1,004 of the working proxies (5.15%) were malicious or unwanted: 47% of those injected ads, 39% added tracking or fingerprinting code and 12% tried to redirect users to malware pages (Tsirantonakis et al., abstract, Table I and §IV).
Mani et al. found that about 8% of responsive proxies sometimes returned unexpected content, and in a one-day sample 2.2% of all HTML requests came back malicious, with ad injection, cryptocurrency-mining scripts and eavesdropping among the behaviours. Separately, 413 of 21,385 proxies (1.93%) swapped a downloaded Windows .exe for a trojaned one at least once (Mani et al., §6 and §7.1).
The one that surprises people: 9,079 of 13,740 proxies (66.08%) in that study added a header, mostly X-Forwarded-For, that passed the user’s real IP address to the website (§5.3). A free proxy often doesn’t even hide you.
The 2024 study adds the other side of the risk. Shodan showed 13,742 proxy IPs with at least one known vulnerability, 4,452 distinct CVEs in all, and the authors count 1,755 vulnerabilities that allow remote code execution, which fits the authors’ picture of hijacked machines (Mehanna et al., abstract and §IV-B).
Doesn’t HTTPS fix this? #
Mostly, if the proxy supports it and you never click past a certificate warning. Through an HTTP CONNECT tunnel the proxy only relays encrypted bytes to the site you named, what the standard calls “blind forwarding”, so it can’t read or edit the page (RFC 9110 §9.3.6). Over plain HTTP, it can read and change everything.
The two studies that measured HTTPS support disagree, so here they are side by side rather than blended:
| Study | Years | What was checked | Finding |
|---|---|---|---|
| Mani et al. | April–May 2018 | Whether proxies that returned the expected content would also pass TLS | 70% (14,607 of 20,893) did. Of the HTTPS-capable ones, 1.06% (102 of 9,625) tried a man-in-the-middle with a swapped certificate |
| Mehanna et al. | 2021–2023 | Whether responsive HTTP proxies also answered on an HTTPS endpoint | On average 371 per run did, 2.5% of responsive HTTP proxies (last 477 runs) |
Different years and different tests, so I wouldn’t average them. Both point the same way for you: HTTPS through a free proxy isn’t a given, and a certificate warning is the sign that something in the middle is trying to read your traffic.
Some free apps make you the proxy #
“Free” isn’t only about lists. The FBI warned on March 12, 2026 that “Free VPN services may enroll users’ devices in a residential proxy network, without obtaining their consent”, and it flagged passive-income apps, sideloaded apps and TV boxes that promise free content (FBI PSA I-031226-PSA).
The US Treasury’s May 28, 2024 sanctions on the 911 S5 botnet network say its administrator was the registered subscriber to two VPNs, MaskVPN and DewVPN, “specific to the botnet operation” (Treasury). Google’s January 29, 2026 IPIDEA report names free VPN apps, Galleon VPN and Radish VPN, that joined devices to a proxy network through SDKs (Google).
So a free VPN or an “earn money from your bandwidth” app may be paid for with your own connection. If privacy is the goal, my residential proxy vs VPN explainer covers what a paid VPN does and doesn’t do.
Why do sites block free proxies so fast? #
Because the lists are public. Every study above built its dataset by repeatedly downloading public proxy lists, and nothing stops a website’s operator from doing the same and blocking every IP on them.
Even legitimate free tiers share this problem. Webshare’s own help page says its free proxies are shared with multiple users, so they “may be blocked by some sites” (Webshare help).
Tor shows the same effect at larger scale. The Tor Project says its users see CAPTCHAs because many people share the same exit relays, and abuse systems “simply can’t tell Tor traffic apart from suspicious traffic” (Tor Project). I found no sourced block rate for free proxies, so I won’t invent one.
Which free options are actually fine? #
A handful of companies give away a small amount of proxy traffic or credit. Only Webshare’s is free in the plain sense; the rest are trials, credits or a cheap sample. Verified November 12, 2026.
| Offer | What you get | Card? | The catch |
|---|---|---|---|
| Webshare free plan | 10 datacenter proxies, 1 GB a month, no time limit | “No credit card required” (pricing page) | Shared, and “may be blocked by some sites” (help); datacenter only |
| Decodo trial | 3 days of access; 100 MB per its residential FAQ | Yes, plus a possible $1.00 temporary check | The MB figure isn’t on the trial page itself |
| Oxylabs welcome credit | $5 credit | Not stated | For “verified company registrations” only |
| NodeMaven sample | 750 MB | Paid: $3.50, one per account | Not free; ends when the traffic is used |
| ZenRows free plan | 5,000 scraping-API credits a month | No card | An API, not raw proxies |
My guide to residential proxy trials has the full fine print, and the free web scraping API guide covers the API route. What Webshare charges once you outgrow its free plan is in Webshare pricing, explained.
What does paid cost at the low end? #
A few dollars. Here are four entry points I checked on November 12, 2026:
| Plan | Price | What you get |
|---|---|---|
| Webshare datacenter | $2.99/month | 100 proxies, 250 GB of bandwidth |
| DataImpulse datacenter | $5 intro pack (new users), then from $0.50/GB | 10 GB, traffic doesn’t expire |
| DataImpulse residential | $1/GB; $5 intro pack for new customers | 5 GB for $5, “No subscription, no monthly minimum” |
| Decodo residential | $4/GB pay as you go | Wallet top-up, one GB at a time |
Datacenter IPs are the cheap default. Residential costs more per GB but exits through household connections on consumer ISPs, which, according to the IP-intelligence company Spur, makes traditional reputation checks “often less effective” (Spur FAQ). My residential vs datacenter explainer covers when you need which, and proxy pricing models explains per-IP versus per-GB billing.
Does paying make a proxy safe? #
Not automatically. The NDSS 2018 study included one paid subscription list, and it was no cleaner: the paper’s Table II puts the malicious share of its working proxies at 6.16% (61 of 990), against 5.82% (872 of 14,973) for the free public lists (Tsirantonakis et al.).
Google’s January 29, 2026 IPIDEA report attributes SDK, consent and reseller-opacity findings to its investigation, and its July 3, 2026 NetNut report describes actions taken “in coordination with the FBI, Lumen, and others”. They support asking any paid provider where its IPs come from; they don’t establish that every residential provider works that way (IPIDEA report, NetNut report).
When I looked on November 12, 2026, netnut.io was headed “Seized by the Federal Bureau of Investigation”. That’s an observed page state; I didn’t establish the underlying court order (observed notice). So pay, but pay a company that tells you where its IPs come from: my ethical sourcing checklist has the questions, and are residential proxies legal? covers the legal side.
What other pages say, checked against the studies (November 12, 2026)
- “Free proxies die within hours.” The long-run study tested once a day, so it can’t see hours, and almost half of its ever-active proxies stayed up six days or more. The real problem is that only 3.36% worked on an average day.
- “About 80% of free proxies lack HTTPS.” One study (2021–23) found just 2.5% answering on HTTPS; another (2018) found 70% passing TLS. Neither supports 80%.
- Unnamed “independent tests” of 500 or 100 free proxies. No tester, date or method is given, so I don’t repeat the numbers.
- CAPTCHA and block rates for free vs paid, such as 12–18% against 0.4%. No method is given, and I found no study that measures them.
- “Paid IPs come from opted-in, paid users.” That describes some providers’ stated policies, not something you get by paying; see the Google reports above.
If you use a free proxy anyway #
Sometimes you just want to see what a page looks like from somewhere else. If so, these six rules come straight from what the studies found:
- Only visit HTTPS sites. Over plain HTTP the proxy can read and rewrite everything.
- Never log in or type anything personal. Treat every keystroke as visible to a stranger.
- Stop at any certificate warning. That’s how the man-in-the-middle cases in the 2018 study showed up.
- Never download files through it. 1.93% of proxies in one study tampered with an .exe.
- Compare a page you know. Load it with and without the proxy; any difference means the proxy is changing content, which is how the researchers caught it.
- Assume it reveals your IP, and move on quickly. Two-thirds of proxies in one study passed your address along, and most listed proxies stop working anyway.
Which one should you pick? #
Learning, or scraping a practice site: start with no proxy. If you need a different IP, Webshare’s free 10 datacenter proxies are the only proxy offer in my table that is both free and card-free.
Anything with a login, a card or personal data: never a public list. The tampering, IP-leak and certificate findings above are reason enough.
A small scraping job on a budget: Webshare’s $2.99 plan for 100 datacenter proxies first. If the site blocks datacenter IPs, move to DataImpulse residential at $1/GB, which has no subscription and no expiry.
You want the data rather than the IPs: a scraping-API free tier, which handles proxies for you. My scraping API vs proxies comparison explains the trade-off.
Private browsing: a paid VPN. A free proxy list, or a free VPN that may enroll your device, works against the very thing you want.
FAQ #
Are free proxies safe? #
Not for anything you care about. In a 2018 study, 5.15% of working open proxies served malicious or unwanted content, and in another, 66% of proxies added a header that revealed the user’s real IP. For a practice site with nothing personal involved, the risk is smaller, but HTTPS and a throwaway environment still matter.
Do free proxies work for web scraping? #
Barely. A 2021–2023 study found only 3.36% of listed free proxies working on an average day, and sites can block every IP on a public list. For real scraping, a $2.99 datacenter plan or a scraping-API free tier is a better start.
Are paid proxies faster than free ones? #
I couldn’t find a study that measures both the same way. The only measured free-proxy figure I found is an average of 128.5 KiB per second on 1 MiB downloads in 2018. Vendor latency claims on other pages name no method, so I don’t repeat them.
Can I try a paid proxy without a subscription? #
Yes. Webshare’s free tier needs no card, NodeMaven sells a one-time $3.50 sample of 750 MB, and DataImpulse sells residential traffic at $1/GB with no subscription and no expiry. Prices verified 2026-11-12.
Is Tor a free alternative? #
For privacy, it’s a far better free option than a proxy list: a 2018 study found no file or certificate tampering on Tor exits over 26 days. For scraping, expect CAPTCHAs, because the Tor Project says many people share the same exit relays and abuse systems can’t tell them apart.
Is it worth paying if I only need a proxy now and then? #
Usually yes, because occasional use is cheap. DataImpulse’s $5 intro pack is 5 GB of residential traffic that never expires, and Webshare’s free tier gives 1 GB a month of datacenter traffic. Prices verified 2026-11-12.
Sources
23 sources, accessed .
Official pricing, docs, changelogs and status pages 17
- RFC 9110 HTTP Semantics, section 9.3.6 CONNECT
- FBI PSA I-031226-PSA on residential proxy networks, 12 Mar 2026
- US Treasury: sanctions on the 911 S5 botnet network, 28 May 2024
- Google Threat Intelligence: IPIDEA report, 29 Jan 2026
- Google Threat Intelligence: NetNut report, 3 Jul 2026
- Webshare help: free proxies
- Webshare pricing
- DataImpulse residential pricing
- DataImpulse datacenter pricing
- Decodo free trial page
- Decodo residential proxies (trial FAQ)
- Decodo residential pricing
- Oxylabs free trial page
- NodeMaven trial FAQ
- ZenRows pricing
- Tor Project support: why CAPTCHAs appear
- Spur FAQ: why residential proxies are harder to detect
Independent benchmarks and published studies 5
- Mani, Vaidya, Dworken, Sherr: An Extensive Evaluation of the Internet's Open Proxies (arXiv, 2018)
- Mani et al., full text (arXiv v1 PDF)
- Tsirantonakis et al.: A Large-scale Analysis of Content Modification by Open HTTP Proxies (NDSS 2018)
- Mehanna, Rudametkin, Laperdrix, Vastel: Free Proxies Unmasked (MADWeb 2024)
- Mehanna et al., full text (arXiv HTML)
