Is Proxy-Cheap Proxy Manager safe?
We analyzed Proxy-Cheap Proxy Manager version 1.6.3's actual code and gave it a 68/100 trust score. This is a legitimate but highly privileged proxy…
Bottom line
This is a legitimate but highly privileged proxy manager with limited evidence of misuse and meaningful privacy and traffic-routing risks.
What it can access
It can route all browser traffic, answer proxy login challenges, read a service cookie, and change WebRTC privacy settings, which fit proxy management but are powerful [Q1][Q4][Q9][Q18].
Security weaknesses
A wrong or compromised proxy or PAC setting could route browsing through an unintended service, while stored proxy credentials increase the impact of account compromise [Q9][Q20].
Signs of misuse
It sends persistent analytics identifiers and uses a service login cookie for proxy imports, but the evidence does not show unrelated collection or misuse [Q6][Q13][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can set the global browser proxy, respond to proxy-authentication requests, read a service cookie, observe tabs, and change WebRTC privacy policy.
Requests proxy, webRequest, webRequestAuthProvider, cookies, tabs, privacy, storage, and all-URL access. — manifest.json:3
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts and no scripting permission. — manifest.json:3
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No page content script is declared. — manifest.json:3
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores proxy credentials, a Proxy-Cheap token, proxy/PAC settings, bypass rules, analytics IDs, and active-tab URLs in extension-local storage.
Defines local token, proxy-settings, tab-status, client-ID, session, and bypass-list records and persists tab URLs. — background.js:30-34
Defines the same local stores for the UI, including jwt and proxy credentials. — chunks/listener-Bssjlxja.js:106
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests none of those permissions. — manifest.json:3
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends product analytics to Google, imports purchased proxies from Proxy-Cheap, and routes browser traffic to the proxy or PAC service chosen by the user.
Posts analytics events to Google Analytics with a random client ID and session ID. — background.js:33
Calls api.proxy-cheap.com/services/proxies with the user's Proxy-Cheap bearer token. — chunks/listener-Bssjlxja.js:106
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The API import retrieves the user's active purchased proxy records. — chunks/listener-Bssjlxja.js:106
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
A saved proxy is restored on browser startup or tab activation, consistent with persistent proxy-manager behavior; the user can disconnect it.
Restores saved proxy configuration on tab activation and provides an explicit disconnect path. — background.js:31-34
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It changes Chrome's global proxy setting and WebRTC IP-handling policy while connected, then restores both on disconnect.
Calls proxy.settings.set/clear and changes webRTCIPHandlingPolicy between disable_non_proxied_udp and default. — background.js:31-34
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Retains descriptive ProxyService, ProxyManager, TabManager, and Analytics logic. — background.js:31-34
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses packaged handlers and Chrome proxy APIs. — background.js:1-34
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
TabManager records tab ID, URL, index, timestamps, and proxy status in local storage. — background.js:31-34
Does it create a persistent ID or browser fingerprint to recognize you?
Google Analytics receives a persistent random client ID, session ID, and extension events; observed events do not include browsed-page URLs.
Creates a UUID client ID and posts install, connect, disconnect, and proxy-error events. — background.js:33
Sends extension-page views and clicked button IDs. — chunks/listener-Bssjlxja.js:210
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads only the app.proxy-cheap.com JWT cookie for account import and supplies stored proxy credentials only for isProxy authentication challenges.
Gets cookies for the fixed Proxy-Cheap app URL, selects the environment-specific JWT cookie, stores it, and sends it to the Proxy-Cheap API. — chunks/listener-Bssjlxja.js:106
Returns saved username/password only when onAuthRequired reports an actual proxy challenge. — background.js:30-34
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or media-capture permissions. — manifest.json:3
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable interface. — manifest.json:1-3
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts. — manifest.json:3
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
Its core function is routing browser traffic through fixed proxies or PAC rules and answering proxy-authentication challenges.
Builds fixed_servers or pac_script configurations, installs them through chrome.proxy, and supplies proxy credentials. — background.js:31-34
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Sets Chrome pacScript.url or packaged PAC data from the selected saved configuration. — background.js:31-34
Lets the user enter, preview, and save a PAC URL or source code. — chunks/options-Dy9b8Bhn.js:142
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content script or external messaging surface. — manifest.json:1-3
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Implements explicit set/disconnect flows, bypass lists, conflict checks, and disable_non_proxied_udp while proxied. — background.js:31-34
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runtime behavior is proxy configuration, authentication, tab state, and analytics. — background.js:31-34
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or scripting permission. — manifest.json:3