HTTPS Proxy

The term HTTPS proxy is used two ways. Most often it means an HTTP proxy that can handle HTTPS destination traffic through the CONNECT method. More precisely it means a proxy whose own connection from your client is wrapped in TLS, so the hop between you and the proxy is encrypted rather than plaintext. That distinction matters on hostile networks, where an ordinary HTTP proxy would expose your requests and credentials to anyone watching the local link.

With a TLS-secured proxy your client performs a TLS handshake with the proxy before sending requests, so metadata and credentials to the proxy are protected in transit. For encrypted destinations the proxy still tunnels the end-to-end TLS session via CONNECT and cannot read it. The destination sees the proxy's exit IP. Note that for HTTPS websites your traffic is already encrypted end-to-end regardless, so the extra client-to-proxy encryption mainly guards the proxy credentials and the list of hosts you visit.

s4m proxies are reached with username/password authentication over the standard HTTP endpoint on port 3128 and SOCKS5 on port 1080. Because they require credentials and most target sites are already HTTPS, your sensitive traffic stays encrypted end-to-end. If you want to encrypt everything leaving your device — including DNS and the destinations themselves — the s4m VPN with WireGuard or OpenVPN wraps the whole connection rather than just web requests. Compare the proxy and VPN options to match your threat model.