The toggle is green. Is the traffic?
Per-site proxy routing, and — on Chrome, Brave and Edge — a check that tells you when your browser is lying about being proxied. Chromium strips SOCKS credentials before they leave, and takes a PAC’s direct fallback silently, with the toggle still green.
Connection check example resultTwo readings, compared. Testing that a proxy server answers is table stakes — plenty of tools do it. This asks the other question: did your browser’s packet actually go through it?
Free, no account: 3 proxies · 20 rules · all four schemes · JSON import & export.
The silent fallback
Your browser will drop your SOCKS password and never mention it.
Not a bug in any switcher, and not fixable by one. It is how Chromium works — tracked upstream as “SOCKS5 authentication support”, never implemented.
You save a SOCKS proxy with a username and password.
Every switcher accepts it. So do we — the form takes socks5://user:pass@gw.example:1080 like anything else.
Chromium strips the credentials.
The proxy API has no credential field and a PAC result line cannot carry one. Your password is stored, displayed — and never sent.
Your proxy refuses the anonymous connection.
As it should. It was configured to require authentication.
What happens next depends on the PAC.
Offer Chromium a direct fallback and it takes one — no warning, no console line, the toggle still green and your traffic leaving bare. Configure the SOCKS proxy directly instead and it refuses outright. Neither answer authenticates.
Plenty of tools can test a proxy server. The failure that matters is different: the proxy is fine — your browser just isn’t using it.
Chromium issue 40323993 — “SOCKS5 authentication support”, formerly crbug 256785. Still not implemented.
How these were tested, what is fixed, and what no browser has watched yet
Built to report, not reassure
A status light that is allowed to say “I don’t know.”
The check reads your egress address twice — once with the proxy in the path, once with it deliberately out — and compares. The work went into the honest negatives: the answers most tools round up to green.
You press it. It never runs itself.
An egress check is an outbound request to a third party, so it happens only when you click — never on install, on startup, or on a timer. One named address, Cloudflare’s cdn-cgi/trace, with no cookies and no redirects.
userInitiated: required · credentials: omit · redirect: error
It refuses to guess.
A proxy on your own LAN egresses through the same address you do, so matching readings prove nothing there — that verdict is inconclusive, and it says so. “Not proxied” is stated only when the mechanism is known, and it names the cause.
SAME_EGRESS_POSSIBLE → inconclusive, never a green light
Warned before, not diagnosed after.
Type a username into a SOCKS proxy on Chrome and the warning appears under the field as you type — the same sentence in the popup, the options page and the check result.
needsChromiumWarning() · one sentence, everywhere
On Chrome, Brave and Edge. The check does not exist on the Firefox build: the Gecko engine imports no verifier and answers no message from the popup, so the button there reports “could not verify” and never a verdict — a missing feature on Gecko, not a broken one. engine/firefox.js
One extension, two engines
The same rules, routed the way each browser actually allows.
On Chromium your rules compile to a PAC applied through chrome.proxy; on Firefox every request is answered live through proxy.onRequest. Same data, same precedence — and here is exactly where the two differ.
| Capability | Chrome · Brave · Edge | Firefox |
|---|---|---|
| HTTP / HTTPS / SOCKS4 / SOCKS5 proxies | All four schemes | All four schemes |
| HTTP / HTTPS proxy with username & passwordAnswered on the 407 challenge, for your stored proxy only — never a blanket reply. | Works | Works |
| SOCKS with username & passwordChromium strips the credentials and silently connects direct. | Impossible — we warn you | Carried nativelyGecko takes the credentials on every request, and the engine sets them. This row has been watched happen against the shipped add-on in release Firefox 153 — see the ledger. |
| Remote DNSsocks5h:// and socks4a:// resolve host names at the proxy, not on your machine. | Supported | Supported |
| The connection checkReads your egress address twice — with the proxy in the path and deliberately out — and compares. | WorksThe verifier is a service-worker subsystem — sw.js owns it. | Not in this buildA missing feature on Gecko, not a broken one — see above. |
| When a proxy dies | Loud, visible errorNever a silent retry over a direct connection — a single-token PAC by design. | Reported honestlyFirefox’s own direct-failover pref is outside any extension’s reach. |
Per-site routing
Seven tiers of precedence, and it tells you which one answered.
Corp hosts through the corp gateway, the staging IP range direct, everything else through your default — written as rules, resolved in a fixed order. Every routing decision carries a reason code, so “why did this site go direct?” has an answer.
Most specific wins, by definition — not by luck
Exact host beats wildcard, longest wildcard beats shorter. A leading *. means the domain and its subdomains; a * anywhere else never crosses a dot, and *.example.com can never be matched by example.com.evil.net. Rules resolve identically in the popup preview, the live engine and the generated PAC.
Bad rules are refused, not “repaired”
A malformed CIDR is handed back with the field named — never quietly rewritten into a pattern that matches everything. A pathological regex is caught before it is stored, because inside a PAC there is no timeout to save you.
DIRECT is a decision, not an accident
Sending a site around the proxy takes an explicit DIRECT target. When nothing matches and no default exists, the result says so — with a reason code, so unproxied traffic is always explained.
Fail loud, never open
Every failure path ends in an error you can see — not a quiet direct connection.
pacScript.mandatory = true
A broken config stops traffic, it doesn’t leak it
Chrome’s default for an unparseable proxy config is “just go direct”. We flip the one flag that makes it fail visibly on the tab instead.
single-token PAC
No silent failover past a dead proxy
A PAC may legally answer “try the proxy, then go direct”. Ours never does — a dead proxy is a visible connection error, not invisible bare traffic.
levelOfControl
We check who actually holds the setting
Another extension or an enterprise policy can take proxy control — and the API still reports success. We read the control level after every apply and report “blocked” honestly.
no dnsResolve()
The PAC never leaks lookups
PAC helpers like dnsResolve leak the very host name you are routing, before any connection is made. The generated script never calls them.
Your data, portable by policy
Arrive with your old config. Leave with everything.
Import from SwitchyOmega backups (.bak) and SmartProxy exports, or from Proxy Captain’s own JSON. JSON export and import are free, forever — portability is never the hostage. Every import ends in an accounting.
Where proxy passwords are kept
In plain text, in your browser’s local extension storage. An extension has no OS keychain, and a key stored next door encrypts nothing. They never leave your machine, are excluded from browser sync, and exports redact them by default — but anyone with your OS user account can read them. Full detail in the privacy policy.
What never leaves your machine
Rules, proxies, credentials, browsing — none of it is uploaded. No analytics, no telemetry, no content scripts, no reading of any page. Exactly three things ever make a request: your own browsing through your proxy, the check you press, and the licence lookup to api.montereystudio.com.
Pricing
Free does the job. Pro removes the ceilings.
The free tier is a working proxy switcher, not a demo — every scheme, both browsers, the connection check on Chromium, and your data free to leave whenever you like.
Free NO ACCOUNT
$0Installed is signed in. Works offline.
- 3 proxies — HTTP, HTTPS, SOCKS4 and SOCKS5, credentials included
- 20 rules — exact-host and wildcard, with the full precedence engine
- Global on/off toggle and per-site routing
- The connection check on Chrome, Brave and Edge — every honest verdict
- JSON export and import — portability is never the hostage
- Import from SwitchyOmega and SmartProxy
Pro ONE-TIME
$19Bought once. No subscription, no renewal, no seat count.
- Unlimited proxies
- Unlimited rules
- Rule profiles — Work, Home, Travel, switched in one click
- Regex, CIDR and keyword rules
- PAC export — take your ruleset to any device that speaks PAC
What Pro will never claim: if a capability isn’t running in the shipped code, it isn’t on this page.
Questions, answered plainly
The answers other listings hope you won’t ask for.
Why does it need the <all_urls> permission?
Does the connection check phone home?
Can you make authenticated SOCKS work on Chrome?
What happens when my proxy goes down?
Is the free tier actually usable?
Stop trusting the toggle. Start checking the traffic.
Free: 3 proxies, 20 rules, all four schemes, no account. Import from SwitchyOmega, export whenever you like.