The proxy is a property of the profile, not of the machine, so two profiles open side by side go out through two different addresses.
Start freeChromium takes one proxy for the whole browser, which is enough right up to the day you need two accounts open at the same time.
The awkward part of an authenticated proxy is not the address. It is the two fields after it, and where they have to be typed.
The command line flag that points Chromium at a proxy carries an address and nothing else. There is no field on it for an account, and the documented way to supply one is an extension that catches the authentication request the proxy sends back.
An extension is reachable from the page through chrome.runtime, which turns the workaround into one more thing telling a site this browser is not an ordinary one. SigoLogin does the authenticating outside the browser instead. A small SOCKS5 server runs on 127.0.0.1, asks for no password of its own, and holds the conversation with the real proxy. Chromium is pointed at that address on the loopback, so the credentials are never anywhere a page can look.
Every profile that opens gets a relay of its own, on a port the operating system hands out at that moment. There is nothing to set up: no listening port in the settings, and no single local proxy shared by everything on the machine.
Two profiles on one relay would be two profiles on one exit address, which is the thing a profile exists to avoid. When a browser closes, its relay is stopped after it and not before, because a browser that loses its proxy mid-run can fall back to going out directly.
SOCKS5, HTTP and HTTPS, with an account or without one. An HTTP and an HTTPS proxy are both reached with the CONNECT method, so the two names in the dropdown are one path underneath. What a proxy entry holds is this, and there is no second tab behind it:
| Field | What goes in it |
|---|---|
| Label | Optional. Your own name for the entry, which is what makes the list readable when twenty of them share one host |
| Protocol | SOCKS5, HTTP or HTTPS |
| Host and port | A host name or an address, and the port your provider gave you |
| Username | Optional. Clearing it clears the password too, because a proxy with no account has no use for one |
| Password | Never shown again once saved. Editing an entry leaves the box empty, and an empty box means keep the password you have |
The password is wrapped with the Windows data protection service before it goes to disk, under a key tied to your Windows account. Copy the data folder to another machine and the password does not come with it: the app says so and stops, rather than opening the browser without it and leaving you a network error to interpret.
Providers export proxies in whatever shape suits them, so four shapes go in as they are: host, port, user and password separated by colons, the account written in front of the host with an at sign, the same four separated by commas, and any of those behind a socks5:// prefix. A prefix on the line wins over the protocol picked in the dialog, since a line that says what it is knows better. Blank lines and lines starting with a hash are skipped rather than counted as failures, and a password containing a colon or an at sign survives: the split is taken at the last at sign and the first colon.
One line that cannot be read does not take the batch down with it. The others go in, and the lines that failed come back to you word for word, which is the only practical way to find the one bad line in a hundred.
Providers also sell one host with the session written into the username. Duplicating an entry copies the password with it, so five sessions are five edits of one character instead of five retyped secrets. What the copy does not inherit is the check result: it has proved nothing yet, and a copy that started with a tick and a time zone it never earned would have a fingerprint built on top of it.
Sending the page requests through a proxy is the easy half. Each of these is a separate way out, in a separate layer, and any one of them left open makes the other three pointless.
If your machine resolves the host name first and then asks the proxy for an address, the lookup has already gone out on your own line. It is not only a matter of privacy: some providers apply the country you chose only when they are handed a name, so a request that arrives as an address comes out somewhere else. We measured one proxy leaving from Thailand for a host name and from Singapore for an address, at the same moment.
The relay hands the name on exactly as the browser gave it and lets the proxy resolve it. The proxy check is forced to do the same, through the same relay, because a check that resolves names on your machine reports a country the browser will never use. A test in the build opens a connection to a host name through a stand-in proxy and fails if what arrives is an address.
WebRTC does not go through the browser's proxy. Current Chrome hides the local address behind an mDNS name, but the candidate it gets back from a STUN server still carries the real address of your line. Measured on our own build before it was closed: a detection page read a United States address over HTTP and a Vietnamese one over WebRTC, on the same profile at the same time.
A profile with a proxy now starts with UDP outside the proxy switched off, so there is no second address left to report. The decision is taken from the profile as it stands at that moment, not from a fingerprint generated earlier: a profile whose fingerprint was made before you attached a proxy used to start without the switch, and nothing on screen said so.
A browser sends anything on the loopback straight out without the proxy, by default and for reasons of its own. A page asking for something on a local address would then be answered from your machine, past everything else on this list. A profile with a proxy is launched with that exemption removed.
Stopping the relay first would leave a browser running with nothing at the other end of its proxy setting, and a browser in that position can fall back to a direct connection. So the order is fixed the other way round: the browser is closed, and the relay it was using is stopped after it.
A browser reporting a Jakarta time zone from an address in Ohio has contradicted itself, and no amount of work on canvas or fonts covers for that. So the time zone is not yours and it is not a setting: it comes from the proxy check, which asks a geolocation service what zone belongs to that exact address.
Not from the country code, which is the shortcut that goes wrong. A table from country to zone gives the United States America/New_York, and a proxy leaving from California is then three hours out. That happened here, on a real proxy, which is why the zone the service returns for the address is what gets used and the country table is only a fallback for the twenty countries it covers.
The accepted languages follow the country, with English added after them. A Vietnamese address gives a profile that asks for Vietnamese first and English second, which is what a browser in Vietnam sends.
When the service answers with an address but no country, the app records no country rather than choosing one. A wrong country drags a wrong time zone along with it, and a profile falling back to a default zone is the smaller problem. The check tells you which of the two happened.
Opening a profile is where a proxy stops being a row in a table. Four states, and each one is settled before Chromium starts rather than after.
| State of the proxy | What opening the profile does |
|---|---|
| Last checked more than ten minutes ago | Checked again, and the answer recorded, before the fingerprint is built from it |
| Answers | The browser starts, on the time zone and the languages of the address that answered |
| Does not answer | The profile does not open, and you get the reason: a refused account, a wrong address or port, or ten seconds of silence |
| Host, port or account edited since | Saving the edit cleared the old answer, so this counts as never checked and is checked now |
Ten minutes is not a round number chosen for comfort. A rotating proxy holds an address for a session and then changes it, and we recorded one answering from Singapore and, later in the same session, from India. A profile opened on the older answer would declare a Singapore clock while leaving from India, which is the contradiction this whole page is about.
Two things reach our server when you open a profile: whether that profile had a proxy at all, and the country it came out in. Which proxy it was, and which address, are not part of that record, and no proxy of any kind is part of the profile list this website shows you.
The exit address does travel once. Our browser only runs on a fingerprint our server has signed, and the address is part of what gets signed, so it goes up with the rest of the fingerprint and comes straight back signed. The server does not keep it.
Proxy passwords, and the passwords and 2FA keys of saved accounts, are the secrets the app has to keep on disk. They are wrapped with the Windows data protection service and the key is tied to your Windows account, so copying the data folder to another machine or another user does not carry them with it.
Error messages are scrubbed before they leave your machine. Any address shaped like scheme://user:password@host has its login replaced with three asterisks, and anything past 500 characters is cut. The host and port are kept, so a failed proxy connection can carry that proxy's address and port.
All of the above happens once, in a few seconds, out of sight. This is the part you work with.
Nothing on this page is held back for a paid plan. What the plans change is how many profiles you may keep and how many machines you may activate.
| Feature | Free | Personal | Professional | Business |
|---|---|---|---|---|
| Authenticated proxies, no DNS leaks | ||||
| Time zone and language follow the proxy country | ||||
| Profiles | 3 | 50 | 300 | Unlimited |
Proxies are not counted and not sold here. The app puts no limit on how many entries you keep, and there is nothing in it that buys addresses for you.
Bulk add takes the block the way your provider exported it. Pick the protocol once, for the lines that do not declare their own.
Check all runs every entry at the same time and writes down the address, the country and the time zone each one came back with. A dead entry is better found now than at the moment you need that account.
Pick the proxy from the profile's own row. The fingerprint takes its time zone and languages from that address, and one relay starts for that profile alone.
No. Nothing in the app buys, resells or hands out addresses, and there is no provider account to connect. You bring proxies you already pay for, in any of the four shapes a provider usually exports.
SOCKS5, HTTP and HTTPS, with a username and password or without. HTTP and HTTPS are both reached with the CONNECT method, so once the connection is up they behave the same.
No, and that is why the app is built the way it is. Chromium's proxy flag has nowhere to put an account, so the usual answer is an extension that supplies it, and an extension can be asked about from any page you visit. SigoLogin runs a small SOCKS5 server on the loopback and does the authenticating there, outside the browser.
Yes. A proxy is an entry of its own and any number of profiles can point at it, which is also how a changed password gets corrected in one place. They do then share one exit address, so keep that for profiles meant to look related.
The profile does not open. A proxy with no fresh answer is tested before the browser starts, and if it stays silent you get the reason instead of a window. Opening anyway would mean a browser with no connection, or one leaving from your own address.
Not in one action. The proxy is set on a profile from its own row. What does scale is the other direction: one entry serves as many profiles as you like, so a hundred profiles behind one proxy is one entry and one password, not a hundred.
No. Host names are handed to the proxy unresolved, and a test in the build fails if any part of the path resolves one locally. A profile with a proxy also launches with the browser's usual exemption for addresses on the machine itself removed, so there is nothing left that goes around it.
A proxy or a VPN changes the address a request comes from and nothing else; the browser still describes the same computer. The two are complementary rather than alternatives. SigoLogin expects a proxy per profile, and takes the time zone and the language from that proxy's country so they cannot contradict the address.
The free plan takes three profiles, on the same relay, the same DNS handling and the same time zone matching as every paid one.
