Rocket Proxy Checker

A fast, native proxy checker for Apple silicon Macs.

Check thousands of proxies concurrently, resolve their protocol, location and anonymity level, and export exactly the subset you need.

Download RocketProxyChecker.dmg from Releases, open it, and drag Rocket Proxy Checker into Applications.

The build is ad-hoc signed rather than notarized, so Gatekeeper blocks the first launch. Clear the quarantine flag once:

xattr -dr com.apple.quarantine "/Applications/Rocket Proxy Checker.app"

Requires macOS 14 or later on Apple silicon.

Add Proxies accepts a pasted list or a file, and the window accepts drops. Every common format parses:

1.2.3.4:8080
1.2.3.4:8080:user:pass
user:pass@1.2.3.4:8080
socks5://user:pass@1.2.3.4:1080
http://1.2.3.4:3128
1.2.3.4,8080,user,pass

Comments (#, //) and duplicates are dropped automatically. A scheme:// prefix is taken as the declared protocol, which skips detection and speeds up the run.

Press Start (⌘R) to check everything, or use its menu for Retry Failed. Stop is ⌘.

The status bar counts Good, Slow, Timeout and Failed live — click any chip to filter the table to it. Results land sorted fastest-first, and a card summarises the run when it finishes.

Click the target chip in the status bar to change the site every proxy is checked against. Defaults to Google.

Filter by status, protocol, country, state, anonymity and a speed ceiling, then choose a line format:

Splitting writes one file per protocol, country, state, anonymity level or speed band — proxies_socks5.txt, proxies_united-states.txt, proxies_elite.txt. Copy sends the same selection to the clipboard instead.

Before any HTTP request, the checker opens a raw TCP socket and speaks each protocol in turn:

1. SOCKS5 — sends the greeting 05 02 00 02; a SOCKS5 server answers 05 <method>.
2. HTTP — sends a CONNECT and looks for an HTTP/1.x status line. A 407 still confirms an HTTP proxy.
3. SOCKS4 — sends a connect request and looks for 00 5A–00 5D.

An HTTP proxy cannot fake the SOCKS5 reply byte and vice versa, so there are no false positives between them. Detection is skipped entirely when the list declares a scheme or a protocol is forced.

Speed is the wall-clock round trip of the target request through the proxy, measured with DispatchTime.

The status column shows the HTTP code the target returned. Only codes the proxy emits count as failure — 401, 407, 502, 503. A 403 or 404 comes from the target, meaning the tunnel worked and the site turned that IP away, which is a materially different result.

Locations resolve in a single bulk pass after the run rather than per proxy. ip-api's free tier permits 45 single lookups a minute but 15 batches of 100, so batching alone is a 33× gain. On top of that:

• only working proxies are resolved,
• duplicate exit IPs collapse to one lookup,
• results are cached to disk for 30 days, so repeat runs cost nothing.

The X-Rl and X-Ttl response headers are honoured as the API requires: at zero remaining, the service waits out the window instead of earning a ban.

Two modes, under Settings → Locate by:

• Proxy address (default) resolves each proxy's hostname locally over DNS. Nothing is sent through the proxies at all.
• Exit IP asks each proxy which address it exits from, then batches those. Slower, but correct for rotating gateways where the address you dial and the node you exit from differ.

Your public IP is fetched once at the start of a run, then each proxy requests a judge page that echoes request headers back:

HTTP proxy credentials go through a URLSessionTaskDelegate; SOCKS credentials use the CFStream SOCKS properties. Self-signed certificates on proxy endpoints are accepted, since certificate validity is not what's being measured.

Requires Xcode 15 or the Swift 5.9 toolchain.

git clone https://github.com/NezzDevs/RocketProxyChecker.git
cd RocketProxyChecker
./build-app.sh         # → "Rocket Proxy Checker.app"
./make-dmg.sh          # → RocketProxyChecker.dmg (optional)
open "Rocket Proxy Checker.app"

Build the bundle rather than running swift run. App Transport Security reads the bundle's Info.plist, which is what permits plain http:// targets such as ip-api.com and azenv.net. A loose binary has no plist, so those requests are blocked before they ever reach a proxy.

Pushing a tag builds and publishes a release automatically:

git tag v1.0 && git push --tags

• ip-api's free tier is non-commercial only and offers no HTTPS. For commercial use or unlimited queries, their pro service is the supported path.
• azenv.net is the default anonymity judge and goes down occasionally. Any page that echoes request headers works — swap it in settings.
• Some headers cannot be overridden. URLSession populates Host, Connection, Content-Length, Authorization and the proxy-auth pair itself. The header editor flags these rather than letting them fail silently.
• Very high thread counts are bounded by your machine, not the app. The file descriptor limit is raised at launch (256 → 16384), but sustained throughput past a few hundred threads depends on your network rather than the checker.

Licensed under the GNU General Public License v3.0.

You are free to use, modify and redistribute this software. If you distribute a modified version, you must release its complete source under the same license, preserve the copyright notices, and state what you changed. Closed-source forks are not permitted.

Contributions are welcome and are accepted under the same terms.