Residential, datacenter, ISP or mobile proxies: which one a profile needs

For a browser profile that signs in and comes back, the short answer is: a static ISP or sticky residential proxy, one per profile, in the country the account belongs to. Datacenter proxies are fast and stable but their addresses are easy to recognise as hosting. Mobile proxies share carrier addresses with many real people and suit tasks that need a phone network. Rotating sessions suit one-off visits, not accounts.

Below: what each type is, how a website sees it, sticky or rotating, which protocol, and how to check where a profile really exits.

What a website sees when you use a proxy

A proxy makes your connections for you, so the website sees the proxy's exit address instead of yours. From that address a site can learn:

• Who owns it. Every public address belongs to a network with an autonomous system number (ASN), registered to an organisation: a home broadband provider, a mobile carrier or a hosting company. IP databases publish that owner and often label the network as residential, mobile or hosting.
• Its history. Reputation services record what traffic has come from an address before, so a shared address carries everyone's history.
• Shared or dedicated. A dedicated address is yours alone; a shared one serves other customers at the same time.
• How stable it is. Some exits keep the same address for months; others change every request.
• Where it is. The address maps to a country, city and timezone, which a site can compare with what the browser itself reports.

A proxy changes only the address. If the browser still reports your own timezone, language or local network address, the profile contradicts itself, whatever type of proxy it uses. We cover the rest of what a browser gives away in what is browser fingerprinting.

The four types

Datacenter proxies

A datacenter proxy runs on a server in a hosting facility, and its address belongs to a hosting company's network. It is fast, steady and keeps the same address for as long as you rent it. The trade-off is visibility: datacenter ranges are public knowledge, and some sites treat them differently from home connections. Datacenter proxies are best for testing, research on public pages and work where the site does not expect a household visitor.

Residential proxies

A residential proxy sends your traffic out through a home internet connection, so the exit address belongs to a consumer broadband provider. Providers build large pools of these addresses and usually offer two ways to use them: rotating (a new address every request or every few minutes) or sticky (the same address for a set time). Quality varies by provider, and an address may have been used by someone else before you. Ask your provider how its addresses are sourced, and whether the people whose connections are used have agreed to it.

ISP proxies (static residential)

An ISP proxy is a hybrid: the address is registered to a consumer internet provider, but it is hosted on servers in a data centre. The address is usually dedicated to you and stays the same for months. For a long-lived profile that should look like the same place on every visit, this is often the best fit.

Mobile proxies

A mobile proxy exits through a 4G or 5G carrier network. Carriers place many subscribers behind a small number of public addresses (carrier-grade NAT, described in RFC 6888), so one mobile address is shared by many real people at once. Mobile addresses also change as the carrier reassigns them, and most providers give you a link that asks for a new address on demand. They are best for tasks that need a carrier network, such as checking how a mobile site or app behaves in one country.

Sticky or rotating: why a signed-in profile wants a stable exit

The type tells you who owns the address. The session tells you how long you keep it.

• Static: the same address for months. Usually a datacenter or ISP proxy.
• Sticky: the same address for a while, often from a few minutes to a day, as long as the provider keeps the session.
• Rotating: a new address on its own, often every request or every few minutes.

A profile that signs in, keeps a cart or comes back as the same person wants the same exit each time. Each new exit looks like a new place, and a site may ask the profile to sign in again, or check it, when its address keeps moving. Rotation suits throwaway profiles and one-off visits, such as reading a public price page once. See rotating vs sticky for how Browz labels and assigns each kind.

Which protocol: HTTP, HTTPS, SOCKS5 or SSH

The protocol is how your computer talks to the proxy. It does not change the exit address, but it changes what someone between you and the proxy can see.

• HTTP: the most common. Sites you open over HTTPS are still encrypted end to end, tunnelled with the CONNECT method (RFC 9110), but the request to the proxy itself, credentials included, is not.
• HTTPS: the same as HTTP, with the hop to the proxy encrypted. Choose it only if your provider gives you a TLS port for the proxy itself.
• SOCKS5: carries any kind of traffic and can take a username and password (RFC 1928).
• SSH: a server you sign in to, used as an encrypted tunnel. A simple way to exit from a server you already run.

Whichever you choose, keep DNS at the proxy. DNS turns a site name into an address; if your own network resolves the names, your resolver sees every site the profile visits, even though the pages themselves go through the proxy. Our DNS and WebRTC guide explains the settings.

One proxy per profile

Profiles stay apart only if their exits do. Two profiles on the same exit share an address, and a site that sees them come from the same place at the same time has a simple reason to treat them as related. If the accounts should not look related, give each profile its own proxy: its own static address, or its own sticky session from a residential pool. Many residential providers pick the session from the username, so one pool can give each profile its own exit.

The second rule is that a proxy should never fail open. If a profile's proxy goes down and the browser quietly falls back to your own connection, the site sees your real address once, and that is enough to connect the profile to you.

How Browz checks the exit

Browz works with proxies from any provider; it does not sell them. Each profile gets its own proxy, over HTTP, HTTPS, SOCKS4, SOCKS5 (with or without credentials) or SSH (with a password or a private key), and the credentials are sealed in an encrypted store the moment you save them (proxies feature page).

• The real exit, measured. Every check opens a real tunnel through the proxy and measures the exit over HTTPS: the exit IP, country, city and timezone. You can add a second lookup service, and an offline GeoLite2 database, to compare readings.
• The profile follows the exit. Leave a profile's timezone, language and WebRTC on automatic and Browz sets them from where the proxy really exits, measured at each check, so the profile does not contradict its own address. WebRTC is derived from the proxy by default, so no local address is exposed.
• DNS at the proxy by default. Site names resolve at the proxy, so your own network never sees which sites a profile visits.
• No silent fallback. A profile with a proxy is checked at every Start. If the exit lookup does not come back through the proxy, Start is refused, and Browz never launches the profile on your own connection instead.
• Launch guards. In Settings › Network and proxies you can turn on Only launch with a working proxy, Refuse if the exit country changed and Refuse when the exit timezone is disputed. A refused start begins with REFUSING TO LAUNCH and names the profile (proxies and launch refusals).
• Mobile change-IP links. Save a mobile provider's change-IP link with the proxy, and Change IP calls it once, then checks the proxy until the exit is really new and in the same country (mobile proxies).

The guides for each type, including residential and datacenter and static proxies, are in the proxy integrations.

Which proxy for which job

Use each site only as its terms allow; a proxy changes where a profile connects from, not what is permitted (acceptable use).

Step by step: add a proxy to a profile in Browz

Have your provider's list ready. Browz accepts host:port, host:port:user:pass and URL forms, so a list like this pastes as it is:

1. Open Proxies and choose + Add for one proxy, or Bulk import to paste the list. For an SSH server, choose + SSH, confirm the server's host-key fingerprint, and Browz pins it.
2. Choose Check on the proxy row. Browz connects through the proxy and reports the real exit IP and location. If the check reports an error such as authentication rejected (HTTP 407), see fix a proxy that is not working.
3. Assign the proxy to a profile in the new-profile panel or the profile drawer. For many profiles at once, select them and choose Assign proxies with the balanced, one-to-one, round-robin or seeded random policy, preview the plan, and apply it.
4. Leave the profile's timezone and language empty, so they follow the measured exit.
5. In Settings › Network and proxies, turn on the launch guards you want, such as Refuse if the exit country changed for a profile that should always come from one country.

To give a profile a new exit later, use Change IP on the profile row (change IP).

Frequently asked questions