ProxyTool Documentation

ProxyTool is a Windows desktop application that routes your internet traffic through proxy servers at the kernel level. It intercepts connections using a WFP (Windows Filtering Platform) driver, giving you full control over which applications use which proxy — without modifying individual app settings.

Quick Setup (3 Steps)

• Add a proxy — Enter your proxy server details (host, port, protocol) or paste a proxy string
• Create a routing rule — Choose which applications or traffic should use the proxy
• Activate — Traffic is immediately routed through the proxy

Account & Sign-In

ProxyTool uses a unified account for the web dashboard and desktop client. Sign in at /auth/login with email and password. If two-factor authentication is enabled, complete the TOTP or email OTP step before access is granted.

Overview Chains & Bandwidth Live Connections Live Logs Customize

‹ ›

Dashboard overview with stat cards, proxy list, and routing rules

1 / 5

Dashboard at a Glance

The Dashboard is your central hub — it shows everything happening on your network in real time. Here's what each section does:

Customize Your Dashboard

Click Customize in the top-right corner to enter edit mode. A toolbar appears at the top of the dashboard where you can control every section individually.

Stat Cards

Toggle each metric card on or off — disabled cards are hidden from the dashboard entirely.

Widget Panels

Each widget panel represents a major dashboard section. Disable panels you don't need to keep things focused.

Layout Options

• Connections Height — Choose between 280px, 400px, 520px, 640px, or 760px to control how many connection rows are visible without scrolling
• Reorder — Drag the arrow handles between stat cards to rearrange their order
• Fine-tuning — Drag the grip under the Connections panel to adjust its height precisely

Click Done to save your layout. Use Reset All to restore the default arrangement, or Clear to remove all customizations and start fresh.

Click Add Proxy on the Proxies page to open the configuration dialog. You can either fill in fields manually or paste a proxy string for instant setup.

Server Details HTTP / HTTPS SOCKS4 SOCKS5 Auth HTTP/S Auth & DNS Auth SOCKS5 User-Agent Advanced

‹ ›

Server Details — common to all protocols: name, host, port, and type selector

1 / 9

Server Details

These fields are identical for every proxy type. Enter address details manually or use Quick Add: paste a proxy string (e.g. socks5://host:port:user:pass) or a curl -x command and all fields auto-fill instantly.

Options by Protocol

The options shown below the protocol selector differ depending on the type you choose. Use the carousel tabs above to compare each protocol side by side.

Authentication Details

Toggle Requires Authentication (or User Identification for SOCKS4) to reveal credential fields. The layout changes per protocol:

Send User-Agent (HTTP / HTTPS only)

When enabled, ProxyTool adds a User-Agent header to the HTTP CONNECT handshake. Some proxies require this to allow the connection. A default Chrome 131 string is pre-filled, but you can set any custom value. This option does not appear for SOCKS4 or SOCKS5 because these protocols do not use HTTP headers.

SOCKS4a Extension (SOCKS4 only)

Standard SOCKS4 resolves hostnames locally before forwarding — which leaks DNS queries. With SOCKS4a enabled, the hostname is sent to the proxy for remote resolution, keeping your DNS private.

Cost per GB

Available for all protocol types. Enter your cost rate (e.g. $2.50 /GB) to enable real-time cost tracking in the Connection Monitor — especially useful for residential or metered proxies.

Expand the Advanced Options section in the Add Proxy dialog to access these settings. They apply to all proxy types unless noted.

Advanced Options expanded — auth prompts, authentication URL, and Use Target Hostname

Inline Proxy Checker

Before saving, click Check to verify connectivity. The checker runs a multi-step test against a configurable target (default: google.com):

• Proxy connection — TCP connect to the proxy server, measures latency
• HTTPS handshake — Sends the CONNECT request to the proxy
• Authentication — Handles proxy auth (407 response → sends credentials)
• Credential check — Verifies credentials were accepted (HTTP 200)
• Target connection — Reaches the target through the proxy end-to-end

All steps show a green checkmark on success with detailed status messages. The total latency is displayed at the top right (e.g. 99 ms), and a summary line confirms the result: PASSED — All tests OK.

Inline Proxy Checker — all 5 tests passed (99 ms latency) with target google.com

The Proxies page displays all configured proxy servers in a sortable table with real-time status indicators.

Proxies — Server list with protocol, address, location, latency, and quick actions

Table Columns

Filters & Search

• Search — Filter by name, address, or location
• Type filter — All / HTTP / HTTPS / SOCKS4 / SOCKS5
• Status filter — All / Active / Inactive

Actions

• Toggle — Activates/deactivates the proxy (starts or stops the bridge)
• Edit — Reopens the Add Proxy dialog in edit mode with all fields pre-filled
• Delete — Stops the proxy if active, then removes it. Shows a warning if the proxy is used in chains or rules
• Test — Runs the connectivity checker without opening the dialog

Rules determine which traffic goes through which proxy (or chain), goes direct, or gets blocked. They are evaluated top-to-bottom by priority — the first matching rule wins. Click + Add Rule to open the configuration dialog.

Overview Rule Setup Protocol Direct Proxy Chain Block Advanced

‹ ›

Rules overview — 3 rules with priority ordering, on/off toggles, and action badges

1 / 8

Rules Overview

The Rules page lists all configured routing rules with their priority number, action badge (Proxy / Direct / Block), on/off toggle, and summary tags showing matched apps, hosts, ports, and protocol. Use the up/down arrows on the right to reorder priorities — the first matching rule wins.

Rule Setup

The top half of the dialog defines what traffic this rule matches. All four criteria are optional — leave a field empty (or *) to match everything.

Protocol

Select which transport protocol this rule applies to. The dropdown offers TCP, UDP, or BOTH. Note that UDP routing requires a SOCKS5 proxy — HTTP and SOCKS4 proxies only support TCP.

Actions

The Action dropdown defines how matched traffic is routed. Each action type shows different follow-up options:

When selecting Proxy, the dropdown lists all configured servers with their protocol badge (HTTPS, SOCKS5). When selecting Chain, you choose from your configured chain setups (Load Balancing, Redundancy, Simple).

Priority & Enable

Every rule has a Priority level (1 = lowest, 10 = highest). Higher priority rules are evaluated first. The Enable this rule immediately toggle (on by default) activates the rule right after creation — disable it to save a rule for later use.

Expand Advanced Options at the bottom of the Add Rule dialog (available for Proxy and Chain actions) to access network interface control and IPv6 settings.

Proxy chains combine multiple proxies into a single routing target. ProxyTool supports three chain types — Simple (sequential multi-hop), Redundancy (automatic failover), and Load Balancing (random distribution). Click + Add Chain to open the configuration dialog.

Overview Chain Setup Simple Redundancy Load Balancing Proxy Selection Chain Order

‹ ›

Chains overview — 3 chains with type badges, route visualization, and per-proxy health checks

1 / 7

Chains Overview

The Chains page lists all configured chains with their type badge (Simple, Load Balancing, Redundancy), proxy count, and a route visualization showing the traffic path (e.g. Static Test Proxy → TestProxy1). Expand a chain to see per-proxy health status with test results and latency.

Chain Setup

Enter a Chain Name, then select one of the three chain types. Each type shows its own configuration options below the selector. The Available Proxies panel lists all configured proxy servers — click the + button next to a proxy to add it to the chain.

Simple Sequential Chain

Routes traffic through every proxy in order as a true multi-hop chain. Each proxy becomes a hop between your device and the destination. Adds latency but increases anonymity. The order you set in the Chain Order section determines the hop sequence.

Redundancy Failover Chain

Uses one proxy at a time from the ordered list. Tries the first enabled proxy; if it fails validation within the timeout, automatically switches to the next.

Load Balancing Random Distribution

Distributes connections across multiple parallel proxies. Each new connection gets assigned a random proxy from the pool.

Steps

• 1. Name your chain — Enter a descriptive name (e.g. "Secure Multi-Hop")
• 2. Select chain type — Simple, Redundancy, or Load Balancing — each shows its own configuration options
• 3. Add proxies — Click the + button next to a proxy in the "Available Proxies" panel. Proxies show their protocol badge (HTTPS, SOCKS5) and can only appear once per chain.
• 4. Set order — In the Chain Order section, use the ▲ ▼ arrow buttons to move proxies up or down. Traffic flows top to bottom. Click ✕ to remove a proxy from the chain.
• 5. Configure options — Set type-specific options (timeout for Redundancy, PID stickiness for Load Balancing)
• 6. Save — Click Add Chain. Assign the chain to a routing rule to start using it.

Redundancy (failover)

Pick Redundancy to try proxies in priority order. Configure connection timeout, optional direct fallback, and how often failed hops are rechecked.

Redundancy — failover timeout, direct fallback, and recheck timer

Load Balancing

Pick Load Balancing to distribute connections across the pool. Enable Same proxy for same process (PID) when an app needs a stable IP for its session.

Load Balancing — PID stickiness and available proxies

Adding proxies to the chain

In Available Proxies, click + next to each hop. They appear in Chain Order where you can reorder or remove them.

Available Proxies — add hops with the + button

Chain Order — numbered hops with reorder arrows

Chain Order

The Chain Order section shows all added proxies as numbered cards. Each card displays the proxy name, address, and protocol badge. Use the ▲ (up) and ▼ (down) arrow buttons to reorder — traffic flows from position 1 downward. A visual arrow connects the hops to illustrate the routing path. The counter (e.g. 2 proxies) shows how many are in the chain, with a minimum of 2 required.

Chain List Features

• Type badge — Color-coded: Simple, Load Balancing, Redundancy
• Route visualization — Shows the proxy flow: Proxy A → Proxy B → ...
• Per-proxy health — Expand a chain to see individual proxy test results with latency, e.g. PASSED — All tests OK (98 ms)
• Edit / Delete — Edit reopens the dialog, Delete removes the chain. Shows a warning if the chain is used in routing rules.

The DNS page controls how hostnames are resolved and provides leak-prevention features that keep your real IP address hidden. Three tabs at the top let you switch between detection modes, while the settings below fine-tune privacy behaviour.

Overview Resolve via Proxy

‹ ›

Current DNS Mode

The status badge in the top-right corner (Local DNS or Via Proxy) shows the active resolution path at a glance. Three tabs below it control the detection mode:

Proxifier DNS Settings

Two toggles control the connection between auto-detection and proxy resolution:

• Detect DNS settings automatically — monitors network conditions and switches DNS mode when local DNS becomes unavailable (on by default)
• Resolve hostnames through proxy — sends all DNS queries through the proxy server instead of local DNS. When enabled, the badge changes to Via Proxy and the detection tab switches to Manual / Proxy

Scroll down on the DNS page to find the IP Protection panel. These settings prevent traffic from leaking outside the proxy when the operating system or applications attempt alternative network paths. You can enable everything at once or pick individual modules in custom mode.

The Traffic Monitor page is your real-time command center for network visibility. Two tabs at the top — Analytics and Connections — let you switch between high-level insights and a detailed connection table. Use Freeze to pause all counters for analysis, or Clear to reset session data.

Overview Shield & Health Shield Detail Domain Intel Forensics: Domains Forensics: By Proxy Protocol

‹ ›

Summary Cards

Four cards at the top provide session-level metrics at a glance:

Analytics Tab

The Analytics tab organizes traffic data into several cards that scroll vertically:

Connections Tab

The Connections tab shows a live table of every active and recent connection:

Connection Forensics

Scroll down in the Connections tab to find Connection Forensics. Two sub-tabs — Domains and By Proxy — provide deep analysis:

• Domains — Shows all contacted domains with request count and traffic percentage. The overall block rate is displayed in the header
• By Proxy — Expand each proxy to see success rate, block rate, wasted data, and blocked domains with frequency

Cost Overview

Overview By Proxy By Domain By Process

‹ ›

The Cost Overview card calculates real-time proxy expenses based on the per-GB rate you set on each proxy. The total cost badge (e.g. $0.2298 total) appears in the top-right corner. Four tabs let you slice the data differently:

• Overview — Unified ranking of all proxies, processes, and domains sorted by traffic. Each entry shows a type badge (Proxy / Process / Domain), traffic volume, and cost
• By Proxy — Traffic and cost per proxy endpoint with connection count breakdown
• By Domain — Ranked list of domains by traffic, useful for identifying bandwidth-heavy sites
• By Process — Per-application cost breakdown so you can see which processes generate the most proxy traffic

Cost Optimization

Overview By Proxy By Domain By Process

‹ ›

The Cost Optimization card identifies wasted proxy traffic — connections that were blocked or failed (RST) but still consumed bandwidth. The badge (e.g. $0.0002 wasted) highlights the total wasted cost. Click any entry to expand details:

• Overview — Ranked list of domains with wasted bytes, associated proxy and process, and cost per entry
• By Proxy — Click a proxy to see its top wasted domains and processes. Shows total block count, success rate, and block rate per proxy
• By Domain — Wasted traffic grouped by domain name
• By Process — Wasted traffic grouped by application (e.g. msedge.exe, chrome.exe)

ProxyTool monitors TLS Client Hello packets and compares JA3 fingerprint hashes against a known database. When a connection's fingerprint indicates a potentially detectable automation tool, a warning card appears in the Analytics tab with fix suggestions.

In this example, curl.exe was flagged as DETECTABLE because its TLS fingerprint does not match any known browser. The warning card explains that anti-bot systems like Cloudflare, Akamai, and DataDome compare JA3 hashes against known browsers, and suggests using curl_cffi, Camoufox, or Playwright with stealth plugins instead.

The warning panel shows: process name, number of flagged connections, affected domains (last 5), and process-specific suggestions for fixing the fingerprint.

If you've configured a Cost per GB rate on your proxies, the Monitoring page calculates real-time spending based on actual traffic.

How Cost Is Calculated

• Calculated per proxy based on the rate set in the proxy's configuration
• Includes both upload and download bytes
• Displayed with up to 6 decimal places for precision on small transfers
• Visible in Security Shield events and the Cost Optimization card

Cost Optimization

When you have at least 5 proxied connections, the analytics tab shows a Cost Optimization card that breaks down wasted bandwidth by proxy, domain, and process — helping you identify where to reduce costs.

The Settings page provides centralized control over subscription management, appearance, system behavior, privacy, and diagnostics. A search bar at the top filters settings in real time — type any keyword to locate and navigate directly to the matching setting.

Subscription Appearance & System Profiles Monitoring & Safety

‹ ›

Subscription — Plan, devices, and account management

1 / 4

Settings Search

The search bar at the top of the Settings page provides instant filtering. Typing a keyword (e.g. "tray", "DNS", "encryption") highlights and scrolls to the matching setting, making it easy to locate options without browsing through tabs.

Subscription

General

Safety

Diagnostics

Profiles save your complete configuration (proxies, chains, rules, DNS settings) as portable .ppx files. You can maintain multiple profiles and switch between them.

Profiles Overview Auto Update Encryption & Files

‹ ›

Profiles — Active profile, saved profiles, and migration tools

1 / 3

Active Profile

The current workspace is auto-saved continuously. To persist a configuration as a named profile, use Save As. The active profile name is displayed at the top of the Profiles tab. Additional controls include:

• New Blank — Reset to a clean empty configuration
• Save As — Save current workspace as a named profile
• Import — Load a .ppx file from disk (or a Proxifier .ppx/.xml)
• Export — Save the current configuration to a file for sharing or backup

Saved Profiles

All saved profiles appear in a list below the active profile. Each entry shows the profile name and provides Load and Delete actions. The currently active profile is highlighted. Loading a profile replaces the entire active workspace configuration.

Profile Auto Update

Profiles can be fetched automatically from a remote server. This is useful for team deployments or managed environments where configuration changes need to propagate to all devices.

Password Encryption

Profile files can encrypt stored proxy passwords using one of four modes. The encryption mode selector is a radio button group in the Profiles tab.

Profile Files

Profiles are stored as XML .ppx files. The Profiles tab shows the user profile directory path with a copy button for quick access in file explorer.

• User profile directory — Default location where named profiles are saved
• Default.ppx — Place this file in the application directory or C:\ProgramData\ProxyTool\ to auto-load a profile for all users on the machine
• CLI loading — Run ProxyTool.exe profile.ppx [silent-load] to load a specific profile at launch. The silent-load flag suppresses the load confirmation dialog

ProxyTool can import your existing Proxifier configuration (.ppx / .xml) including proxy servers, chains, rules, DNS settings, and leak-protection options. The import wizard detects all components and guides you through any manual steps required.

Import Preview Password Manager Final Review

‹ ›

Import preview — proxies, rules, and settings detected in the Proxifier profile

1 / 3

What It Imports

• Proxy servers — Host, port, protocol, and authentication credentials
• Proxification rules — Application-based routing rules (process name → proxy assignment)
• Proxy chains — Multi-hop configurations and failover setups
• DNS settings — Name resolution preferences from the Proxifier profile
• Leak-protection options — UDP blocking and related privacy settings

Encryption Handling

Proxifier profiles may store proxy passwords using different encryption methods. ProxyTool detects the encryption mode and handles decryption automatically when possible:

Password Manager Workflow

The Password Manager appears inside the import modal when automatic decryption is not available. It provides a bulk interface for entering proxy passwords:

• Proxy selection — Select individual proxies via checkboxes, or use the header checkbox to select all
• "All same" bulk-apply — Enter one password and apply it to all selected proxies at once
• Per-proxy fields — Individual password input fields for each proxy that needs credentials
• Apply button — Commits the entered passwords to the import configuration
• Progress badge — Shows completion status (e.g. "0/3") indicating how many proxies still need passwords

After Import

Imported items are added to the current active configuration. Proxies, chains, rules, and settings merge into the workspace immediately. To persist the imported configuration as a named profile, use Save As in the Profiles tab.

The Assistant page in the desktop client turns a sentence into a configuration change. You describe what you want — "route Discord through my US proxy", "block Steam", "chain these two proxies" — and the assistant replies with an explanation plus the concrete changes it proposes, shown as cards below the answer.

Step by step in the client

• 1. Open the page — Click Assistant in the left sidebar of the desktop client. The start screen shows three shortcuts: Route Discord sends that request straight away, Parse Proxy String puts the cursor in the input, and Analyze Screenshot opens the file picker.
• 2. Describe what you want — Type into the message box at the bottom, for example "Route Discord through my Evomi proxy" or paste a proxy string such as socks5://user:pass@host:1080. Enter sends, Shift+Enter starts a new line. If you are unsure of an executable name, open the App Catalog, search for the program and click it — its name is inserted into your message.
• 3. Add a screenshot (optional) — Click the image button next to the input or press Ctrl+V with a screenshot in the clipboard. An Image attached chip appears above the input and can be removed before sending.
• 4. Wait for the answer — While the request runs, the input is locked and the client shows "ProxyTool AI is thinking…". A typical answer takes a few seconds.
• 5. Read the reply and its cards — Below the text answer, every proposed change appears as its own card with an icon and a short summary, for example Rule created (6 Apps) or Proxy updated. The chat text is selectable, so you can copy it with Ctrl+C.
• 6. Apply what you want — Click Apply on a single card, or Apply All (n) above the group to take everything at once. Applied cards turn green with a past-tense label and cannot be applied twice; the header switches to All applied (n) once nothing is left.
• 7. Check the result — The change lands in the client immediately. Open Proxies, Routing Rules or Proxy Chains to see it in the normal editors, where you can fine-tune or delete it by hand like any other entry.

Chats, history and the credit badge

• New Chat — Starts a fresh conversation. The previous one is saved automatically and titled after your first message.
• History list — Past chats sit in the panel on the left with a relative timestamp (just now, 2h ago, yesterday). Click one to reopen it, or delete it there. The client reopens your last chat the next time you start it.
• Stored locally — Conversations live in the client's own settings on that machine. They are not synced to the web dashboard and not kept on our servers.
• Credit badge — The header shows your remaining AI credits and refreshes each time you open the page. When the balance is empty it reads No Credits and the assistant replies with an upgrade note instead of running the request.
• Restricted by an admin — If your organisation blocked AI use, the page shows "AI Assistant has been restricted by your administrator" and the input is hidden. If the whole page was hidden, the sidebar entry disappears. See Device Restrictions.

What it can change

What the assistant knows about your setup

So that answers fit your actual configuration, a short summary of the current workspace is sent with every message:

Screenshots

You can attach an image with the paperclip button or paste one with Ctrl+V — an error dialog from an app that refuses to connect, for instance. Accepted formats are PNG, JPEG, WebP and GIF, up to 4 MB per image, at most 5 images and 16 MB per message.

Language and history

The assistant answers in the language you write in. Conversations are stored on your device only — they are not kept on our servers, and clearing them in the app removes them for good.

Requirements and limits

• You need to be signed in — the assistant runs through your ProxyTool account
• Every message costs AI credits
• Up to 10 messages per minute per device, and 15 per minute per account across all clients
• Organisation admins can hide the Assistant page or block its use through Device Restrictions

What leaves your device

The assistant in the Windows client, the macOS client, the Android app and the AI Policy Assistant in the web dashboard share one credit balance per account. You find it under Account → Billing → AI Credits.

Included every month

The monthly allowance resets 30 days after the last reset.

What a message costs

Each request reserves 3 credits, plus 8 credits per attached image. The real cost is then calculated from the tokens the model actually used, with a minimum of 1 credit per message — whatever was reserved but not needed is returned to your balance right away. Short questions therefore usually cost a single credit.

Buying more

Teams

• Members without their own paid plan spend from the organisation owner's balance
• An owner can cap how many credits a single member may use per month; once the cap is reached, the assistant asks the member to contact their admin
• Team root admins can delegate credits to sub-organisations under Account → Billing
• When the balance is empty, the assistant declines the request instead of answering — nothing is charged and nothing is changed

ProxyTool for macOS routes traffic through a Network Extension (system extension) that macOS loads once you approve it. Every connection the extension sees is then matched against your rules — proxy, chain, direct, or block — without changing Chrome, Safari, or any other app.

Quick Setup (4 Steps)

• Sign in — the client opens your browser (PKCE). Your password is never typed into ProxyTool
• Install the system extension — Settings → Engine → Install, then allow it in System Settings when macOS asks. The app must live in /Applications
• Add a proxy and create a routing rule
• Start — sidebar Start, or Start Routing on the Dashboard. Traffic follows the rules immediately

Account & Sign-In

The same account covers the web dashboard, Windows, macOS and Android. Sign in at /auth/login. Two-factor authentication finishes in the browser before the client receives a session.

Overview Customize Logs

‹ ›

Dashboard — stat cards, My Proxies, Routing Rules and Chains

1 / 3

Dashboard at a Glance

Customize Your Dashboard

Click Customize, then toggle each stat card and widget. Reset restores the default set. Done leaves edit mode. Unlike Windows, the macOS layout is remembered after a restart.

Navigation

The sidebar uses the same groups as Windows:

• MAIN — Dashboard, Proxies, Rules, Assistant
• NETWORK — Chains, DNS, Monitoring
• SYSTEM — Logs, Settings

Open Proxies and click + Add Proxy. Paste a provider string into Name (host:port:user:password, a proxy URL, or a curl -x command) or fill in the fields. Test checks the endpoint before you save; Add Proxy stays disabled until Host and Port are valid.

List Server details HTTP options Advanced

‹ ›

Proxies list and the Add Proxy dialog

1 / 4

Server Details

Options by Protocol

Expand ADVANCED OPTIONS in Add / Edit Proxy. The subtitle while collapsed is “Credential prompts and authentication URL”.

Advanced Options — credential prompts when fields are empty or auth fails

Proxy test

Test in the dialog footer runs the checker in place: TCP, protocol handshake, authentication, then a target connection. A success panel shows IPv4 / IPv6 / UDP / Remote DNS badges when the probe can tell. A failure names the stage and, on a credential reject, offers a jump back to the username and password fields.

Test All on the Proxies page runs the same check for every listed server without opening the editor.

The list shows protocol badge, address, IPv4/IPv6, remote DNS, location and latency once a test has run. Search filters name, host, port or location. The protocol chips (All / HTTP / HTTPS / SOCKS4 / SOCKS5) narrow the list.

Proxies — protocol filters, search, Test All and Add Proxy

Row actions

• Test — reachability without opening the editor
• Edit — same dialog as Add Proxy
• Delete — confirms which rules fall back and which chains lose a hop

Select several rows to Test or Delete in bulk. A restriction profile can hide Add Proxy or lock passwords — see Restriction Editor.

Rules are matched top to bottom — the first matching enabled rule wins. Click + Add Rule. Enable or disable a rule from the list (not inside the dialog), so you see immediately which rule takes over. Drag a row, or use the arrows, to change priority. The fallback rule stays locked at the bottom.

Overview Add Rule

‹ ›

Rules list and the Add Rule dialog

1 / 2

Seeded rules

• localhost — Direct for loopback and typical local names
• Default — catch-all, always last. You can change its action (Direct / Proxy / Chain / Block) but not its match fields

Rule setup

Choose… opens a file panel on /Applications. Apple’s own apps are not in that folder — type com.apple.Safari (or ask the Assistant from the notice under the field).

A chain is one routing target made of several proxies. Open Chains and click + Add Chain. Unlike Android, macOS has a Chain Active switch: a switched-off chain stays configured but carries no traffic; rules pointing at it fall back to the global default.

Overview Add Chain

‹ ›

Chains list and the Add Proxy Chain dialog

1 / 2

Type-specific options

1. Chain Name — required, so rules can refer to it
2. Chain Active — leave on unless you want the chain configured but idle
3. Chain Type — Chain, Redundancy or Load Balancing. The purple note under the selector explains the chosen type
4. Available Proxies — click + to add a hop
5. Chain Order — reorder with the arrows; traffic on a sequential chain flows top to bottom
6. Add Chain — then pick it as the action on a rule

TLS to the proxy itself can only be the first hop of a chain. Inner hops cannot wrap another TLS session to the next proxy.

DNS opens Name Resolution. The status card shows what is actually happening right now — with auto-detect on, that can differ from the switch below. Run Probe asks the running extension to check the local resolver (Start routing first).

Name Resolution — current mode, resolution switches, upstream resolvers and name list

Leak protection lives on the same DNS page, in the Leak Protection card — not under Settings (that is the Android layout). Independent of every switch here: when a rule sends a process through a proxy that cannot carry UDP (HTTP, HTTPS, SOCKS4), that UDP is dropped rather than sent in the clear.

Monitoring has two tabs: Traffic Monitoring (analytics) and Live Connections (the table). Logs are a separate sidebar item under SYSTEM.

Analytics Live Connections Logs

‹ ›

Traffic Monitoring — session stats, protection overview and bandwidth

1 / 3

Settings is two columns: a searchable section list, then the page. Five entries — Subscription, General, Engine, Profiles, About & Help. Apply Now in the header pushes unapplied configuration to the running extension.

Subscription General Engine Profiles About

‹ ›

Subscription — plan, licence and sign-out

1 / 5

Subscription

Signed-in identity, plan (for example Team Premium), licence state (whether the engine may use proxies), last online check, and Sign out. Sign-out is never restricted. Seats and billing for a team plan belong to the administrator and are not shown on the device — open Manage Account for those.

General

Engine

Settings → Profiles is a named profile library (Windows-style), not Android’s import/export-only page.

Profiles — library, encryption modes and Proxifier migration

• New Profile… / Save Current Setup as Profile — snapshot of proxies, chains, rules, DNS and leak protection
• Import… / Export Current… — .ppx files, with encryption matching this Mac, none, or a password of their own
• Password Encryption — No encryption; This Mac only (Keychain, the counterpart of Windows “Current user account”); Master password (needs a password set first)

Settings → Profiles → Start Migration… reads a Proxifier .ppx / .xml and shows what it found before anything is changed — including which passwords it can carry over and which have to be typed again. Process names become bundle identifiers where ProxyTool knows the match; edit the rest with Choose… or by typing the bundle ID.

Assistant in the sidebar turns a sentence into a configuration change. Nothing is applied until you click Apply on a card.

Assistant — chat list, credit balance and an Apply card

• Enter sends, Shift+Enter adds a line, ⌘V attaches a screenshot from the clipboard
• Paperclip attaches images (same limits as the other clients)
• Credits are the same balance as Windows, Android and the web policy assistant — see AI Credits & Limits
• A restriction can hide the page or leave it visible but locked

ProxyTool for Android routes traffic through a local VPN tunnel. Every connection on the phone enters the tunnel; the engine then decides — per app, host, port and protocol — whether it goes through a proxy, a chain, direct, or is blocked. You do not change proxy settings inside Chrome, WhatsApp or anything else.

Get the app from Google Play. Phones without the Play Store can take the signed APK from /download.

Quick Setup (4 Steps)

• Sign in — the app opens your browser. Your password is never typed into ProxyTool
• Add a proxy — paste a provider string or fill in host, port and type
• Create a routing rule — pick the apps (package names) that should use the proxy
• Start proxifying — grant the VPN permission when Android asks, then traffic follows your rules

Account & Sign-In

The same account covers the web dashboard, Windows, macOS and the Android app. Sign in at /auth/login. Two-factor authentication (TOTP or email OTP) is completed in the browser before the app receives a session.

Overview Widgets More widgets Customize

‹ ›

Dashboard — tunnel control, stat cards, My proxies and Bandwidth

1 / 4

Dashboard at a Glance

Customize Your Dashboard

Tap the tune icon under the page title to open Customize dashboard. Toggle each stat card and widget, reorder with the arrows, then Done. Reset all restores the default layout.

Navigation

On a phone the floating bar shows Dashboard, Proxies, Rules, Assistant, Logs and Settings. More (the three dots) opens Chains, DNS and Connections. On a tablet you get a sidebar with the same MAIN / NETWORK / SYSTEM groups as the desktop client.

VPN permission

The first Start proxifying asks Android for a VPN. ProxyTool uses that VPN only as a capture interface — it does not send your traffic to a ProxyTool server. Another VPN app cannot run at the same time. Always-on VPN and lockdown (block connections without VPN) are set in Android Settings → VPN, not in the app; Settings → Startup & Tunnel shows the current state and links there.

Open Proxies and tap + Add proxy. Paste a provider string into Proxy name or quick add, or fill in the fields. Supported paste formats include socks5://user:pass@host:port, host:port:user:pass and a curl -x command.

List Server details Options

‹ ›

Proxies list and the Add proxy dialog

1 / 3

Server Details

Options by Protocol

SOCKS4a Extension

Standard SOCKS4 resolves the hostname on the phone first. With SOCKS4a extension on, the hostname is sent to the proxy so local DNS never sees it — the same remote-DNS behaviour SOCKS5 already has.

Expand Advanced options in the Add proxy sheet. The same keys exist on desktop.

Proxy checker

Before you save, open Proxy checker, set a target (default google.com) and tap Check. The steps are DNS resolution, TCP connection, Protocol handshake and Tunnel to target. HTTPS proxies also validate the proxy’s TLS certificate.

Runtime login

When a proxy needs a password, a sheet titled Proxy authentication appears. Save to profile stores the password encrypted on the device; otherwise it lasts for this session only. Ignore this session skips that proxy until you restart.

The Proxies page lists every server with reachability, protocol badge and latency. The subtitle reads e.g. 1 proxies · 1 reachable. Search filters by name, host or type.

Proxies — reachable SOCKS5 server with Test all and Add proxy

Row actions

• Test proxy / Test all — reachability check without opening the editor
• Edit / Duplicate
• Set as default route — points the locked Default catch-all rule at this proxy (or back to Direct)
• Enable / Disable
• Enter credentials / Forget session login
• Delete — shows which rules fall back to Direct and which chains lose a hop

Badges

Default, Disabled, Session login, Login needed, {method} unavailable (NTLM/Negotiate on Android).

Rules are matched top to bottom — the first matching rule wins. Tap + New rule to open the editor. New rules start disabled so nothing routes until you turn them on. Long-press a card to drag it into position, or use the up/down arrows.

Overview New rule Action

‹ ›

Rules list and the New rule sheet

1 / 3

Seeded rules

• localhost — Direct for loopback and private ranges
• Default — catch-all, locked: you cannot delete it, disable it, or edit its targets. Change where leftover traffic goes with Set as default route on a proxy, or by editing the action

ProxyTool itself is never listed in the app picker; its own traffic (licence, heartbeat) always goes direct so the tunnel cannot lock itself out.

Rule setup

Choose installed apps opens a picker split into Apps and System and background packages. Turn on Show every package if the app you want is hidden.

Chips on a rule card call out Catch-all, IPv6, UDP not supported (sequential chain + UDP), {n} hops and Route missing (the proxy or chain was deleted).

A chain is a single routing target made of two or more proxies. Open More → Chains and tap + New chain. You need at least two proxies first. Chains have no on/off switch of their own — assign one to a rule.

Overview New chain

‹ ›

Chains page and the New chain sheet

1 / 2

Type-specific options

1. Name — e.g. “EU double hop”
2. Chain type — Sequential, Failover or Load balancing
3. Hops — add at least two proxies, drag to reorder, enable or disable a hop without removing it
4. Options — timeout / recheck / sticky session as above
5. Create chain — then pick it as the action on a rule

Runtime badges: UDP, TCP only, Used by {n} rules, {n} failed, Proxy deleted. Reset failure status clears a hop that Failover marked down.

More → DNS opens Name Resolution. The status card shows Detection (Automatic / Manual), Resolution (Proxy / Local) and the name-list mode. Changes apply to a running tunnel immediately — tap Apply Settings.

Mode Lists & cache

‹ ›

Name Resolution — automatic detection and Local DNS

1 / 2

Leak protection lives in Settings → Leak protection (and a subset is pushed from a policy). The master switch turns the group on; Detect connection loops works even when the master is off.

There is no “name-resolution loop” switch. The engine always resolves proxy hostnames outside the tunnel, so that loop cannot happen.

More → Connections is the live monitor — one page, no Analytics tab. Freeze, resume, clear history, open Statistics, search, and filter by state, route, protocol or source.

Connections — live table with app, target, rule and traffic

Logs (bottom bar) is the engine log: level and source filters, auto-follow, copy, share, clear, and font size. That is the phone equivalent of the desktop live log stream.

Settings is searchable. A lock banner Managed by your organisation means a restriction profile owns that control.

Profiles Appearance Tunnel Leak protection

‹ ›

Profiles — import, export and Proxifier migration

1 / 4

Profile files

Import and export .ppx configurations from Settings → Profiles. See Profiles & Migration for encryption modes and Proxifier import details.

Appearance

Theme — System, Light, Dark. Language — System default, English, Deutsch. The screen redraws immediately.

Startup & Tunnel

Logging & Diagnostics

Log level (Errors only → Trace), Show direct connections in the log, UDP per-packet logging, retention 100–100000 entries. There is no traffic-dump recorder on Android; a policy may still carry the desktop switch and the app ignores it.

Reset, Support, Account

Restore defaults resets settings and DNS only — proxies, chains and rules stay. Send log to support uploads the stored log and returns a reference number. Sign out is never restricted.

Android has no named profile library. You import and export .ppx files from Settings → Profiles. A policy push from the dashboard is a separate path — see Policy Profiles.

• Export… — pick a name and an encryption mode, then the system document picker
• Import… — Add to the current configuration or Replace the current configuration. Optionally apply settings from the file. Imported rules arrive disabled
• Encryption — None, Basic, Windows account (DPAPI), Master password (GCM), Master password (compatible)

Settings → Profiles → Choose Proxifier profile… merges proxies, chains and rules from a Proxifier .ppx / .xml. Process names are mapped to Android packages where ProxyTool knows the match (Chrome, Firefox, Signal, …). Unknown names stay as they were — edit those rules and pick packages with Choose installed apps.

The Assistant is on the bottom bar. Describe what should run through a proxy; it proposes proxies, rules, chains and settings. Nothing is applied until you tap Apply on a card. Rules created this way are enabled immediately (unlike a manual New rule).

Assistant — quick prompts and credit balance

• Quick prompts: Route an app, Parse a proxy string, Read a screenshot
• Up to 5 images, 4 MB each (PNG, JPEG, WebP, GIF)
• Credits are the same balance as desktop and the web policy assistant — see AI Credits & Limits
• hideAssistant removes the page; canUseAi leaves it visible but locked

The web dashboard at /dashboard is where administrators manage organizations, deploy proxy configurations to managed devices, and control what end users can do in the Windows, macOS and Android clients. It is separate from any client's own Dashboard page — this section documents the web admin portal.

Sidebar Navigation

Plan Features

Deployment Flow

Managed configurations reach devices through groups — not by assigning directly to individual devices:

1. Create a Policy — define proxies, chains, rules, DNS, and app settings in the Policy Editor
2. Create a Restriction (Team Premium) — optionally limit what users can change on Windows, macOS and Android
3. Create a Device Group — add the target devices as members
4. Assign Policy & Restriction to the group — from the Policy or Restriction editor (Summary / Assignments tab)
5. Push — configurations are queued for every device in the group and collected with the device's next heartbeat
6. Verify in Fleet — check device status, applied policy version, and active configuration

Device groups organize managed devices for bulk policy and restriction deployment. Navigate to Management → Groups in the web dashboard.

Creating a Group

Managing Members

• + Add Devices — select one or more fleet devices from a multi-select panel and add them to the group
• Remove — remove individual devices from the expanded group view
• Device count and member previews are shown in the collapsed group row

Assigned Policy & Restriction

When a group has an assigned policy or restriction, they are shown in the group detail panel. To change assignments, use the Policy Editor (Summary tab) or Restriction Editor (Assignments tab).

Policy profiles are managed configurations (proxies, chains, rules, DNS, app settings) that can be pushed to device groups. Navigate to Management → Policies.

Policy List

Apply Mode

On Android, Additive merges proxies, chains and rules into the current file and then applies only the androidSettings keys you marked as managed. Override replaces the file, then applies those settings. Windows devices receive the Windows settings block instead.

Group Assignment

From the expanded policy row or the Policy Editor Summary tab:

• Select a group from the dropdown and click Assign to Group
• If the group already has a different policy, a confirmation dialog asks whether to override
• Assigned groups show device counts and online status; outdated devices (running an older policy version) are highlighted
• Unassign removes the policy from a group without deleting the policy itself

The Policy Editor has six tabs. Use Import .ppx to load an existing Proxifier or ProxyTool profile, or build from scratch. Save with Save or deploy immediately with Save & Push.

Tab: Proxies

Define proxy servers included in this policy. Toolbar: + Add Proxy, Expand All, Collapse All.

Tab: Chains

Tab: Rules

Rules are evaluated top to bottom — rule #1 has highest priority. Built-in rules: localhost (Direct) and Default (Direct).

Tab: DNS & Security

Tab: App Settings

Each setting has a Manage checkbox (include in policy) and a value control. Unmanaged settings stay under user control on the device. The tab is split by platform: a device receives only its own group. An empty group leaves the device on its own defaults — there is no inheritance from another platform. Windows and Linux share the first group (same Qt client). A Mac never receives Windows, iOS or Android keys; an iPhone or iPad never receives desktop or Android keys; Android never receives desktop or Apple keys.

Windows + Linux

macOS

Stored as macosSettings on the policy. Keys match Settings on the Mac. A Mac uses only this group. With nothing managed here it keeps its own defaults — it never inherits the Windows + Linux group.

iOS + iPadOS

Stored as iosSettings on the policy. iPhone and iPad share this group because they are the same app. Keys match Settings on the device. With nothing managed here the device keeps its own defaults — it never inherits Windows + Linux, macOS or Android keys.

Android

Stored as androidSettings on the policy. Keys match the field names on the phone. An Android device uses only this group — it never inherits Windows + Linux, macOS or iOS keys.

Tab: Summary

Shows policy statistics (proxy, chain, rule counts) and the Group Assignments section — assign or unassign groups directly from the editor before pushing.

The dashboard has its own assistant for building policies. Open Management → Policies and click AI Assistant — a panel slides in from the side of the policy list.

What it can do

As in the desktop client, each proposal carries an Apply button and nothing reaches a device before you press it. After applying, the policy list reloads so you can open the result in the Policy Editor and adjust it by hand.

Context and limits

• The assistant sees your existing policies — their names, proxies and rules. Fleet devices, telemetry and screenshots are not part of the request
• Up to 8,192 characters per message, with the last 16 messages of the conversation as context
• Up to 15 requests per minute per account
• Image attachments are available in the Windows, macOS and Android assistants, not in this dashboard panel
• Conversations are not stored on the server — closing the panel or reloading the page clears them
• Messages are charged against the same AI credit balance as the Windows, macOS and Android assistants

Device restrictions control what end users can see and do in the Windows, macOS and Android clients. Available on Team Premium plans. Navigate to Management → Restrictions.

Restriction List

• + New Restriction Profile — create with name and description
• Each profile shows active restriction count and assigned group count
• Edit opens the Restriction Editor
• Delete removes the profile (also unassigns from groups)

Templates

Save & Apply

Save & Apply stores the restriction profile and reports how many devices it covers. Every device in the assigned groups applies it with its next heartbeat, which it sends once a minute. There is no separate push step: each heartbeat carries the restrictions currently in force, so a device cannot stay out of sync.

Three tabs: UI Visibility, Permissions & Locks, and Assignments. Inside each tab the editor groups keys as Shared, Desktop, Windows only, macOS only and Android only, with a badge on every row.

Tab: UI Visibility

Hiding a page removes it from the client's navigation and blocks its route, so a deep link cannot reach it either.

Shared — all three clients

Windows only

macOS only

Android only

Tab: Permissions & Locks

Proxies

Rules

Chains

AI Assistant

DNS & Network Protection

Profiles

macOS only — actions

Settings & System — Windows only

Settings & System — macOS only

Settings & System — Android only

Monitoring & Diagnostics — shared

Tab: Assignments

• Assigned Groups — lists groups receiving this restriction; click Remove to unassign
• Select a group to assign… dropdown + Assign Group button
• One restriction per group — override confirmation if group already has a different restriction
• All devices in assigned groups receive the restriction automatically on push

Monitor all enrolled managed devices. Navigate to Management → Fleet.

Fleet Dashboard

Device Table Columns

Device Detail Page

Click a device row to open its detail view:

• Device Information — platform, OS version, app version, enrollment date, last heartbeat
• Applied Policy — server policy version vs device-reported version; "Update pending" when outdated
• Current Configuration — active profile, proxy list, chains from device heartbeat
• Groups & Tags — group membership and custom tags
• Command History — remote commands with status (PENDING, DELIVERED, EXECUTING, COMPLETED, FAILED, EXPIRED)

Manage organization members and invitations. Available on Team Premium. Navigate to Management → Users.

Tabs

Member Actions

• Change role — assign a different built-in or custom role
• Reset password — force password reset for the member
• Ban / Unban — suspend or restore account access
• Remove from organization — revoke membership

Built-in Roles

Owner, Admin, Operator, Viewer, Device Manager, Policy Manager, Help Desk — plus custom roles created in Permissions & Roles.

Fine-grained access control for dashboard users. Navigate to Management → Permissions & Roles (Team Premium).

Tabs

Permission Categories

Custom Roles

Click Create Custom Role, set name, description, scope (root or sub-org), and pick permissions from the catalog. Custom roles can be assigned to members alongside built-in roles.

Billing

Navigate to Account → Billing.

• View current plan (Standard or Team Premium), cost, device count, renewal date
• Upgrade or downgrade between plans; adjust device seat quantity
• Switch billing interval (monthly / annual)
• Manage in Stripe Portal — update payment method, view invoices
• Cancel subscription or reactivate a cancelled plan
• Team root admins: delegate license and AI credit pools to sub-organizations

Devices (License Slots)

Navigate to Devices in the sidebar (personal license management, not Fleet).

• Shows how many of your subscription's device slots are in use
• Lists active and revoked desktop and Android installations tied to your account
• Remove Device frees a license slot for another installation
• When all slots are used, an upgrade banner links to Billing

Proxies Marketplace

Navigate to Overview → Proxies.

• Marketplace tab — purchase residential proxy bandwidth from Evomi (PAYG or Membership subscription)
• My Products tab — manage accounts, view usage statistics, use the Proxy Generator
• Proxy Generator: configure protocol, countries, session type, output format, and expert multipliers (ISP targeting, TCP fingerprint, etc.)

Account Settings

Navigate to Account → Settings.

• Profile — view name and email (read-only)
• Password — change account password
• Two-Factor Authentication — enable TOTP (QR code + backup codes) or email OTP fallback
• Sign Out — log out of the web dashboard
• Delete Account — permanently delete account (requires password confirmation)

Referral Program

Navigate to Account → Referral to share your referral link and track commissions.

Download Client

Navigate to Overview → Download Client or visit /download. Windows and macOS installers are there; Android is on Google Play, with the APK as a fallback for phones without a store.