How to fix 407 Proxy Authentication Required

Updated: 2026-11-05

A 407 is better news than it looks: your device reached the proxy and the network path is open. The proxy is simply saying it did not receive a valid username and password. That is why almost every 407 is solved on the credentials side, not in your router or firewall.

Private proxies with clear credentials

See proxy pricing Free Proxy Checker

Causes of a 407, most likely first

Wrong or missing username/password. One mistyped character, or a trailing space copied along with the password. This explains most 407 reports.
Fields pasted into the wrong boxes. The whole ip:port:user:pass line ends up in the Host box, or the username lands in the password box. Some tools split the four fields for you, others do not.
The app never sends credentials. An operating-system proxy setting stores only the address and port. Apps that cannot prompt for a password connect without an auth header and get a 407 back.
Special characters inside a proxy URL. In the http://user:pass@host:port form, characters such as @, : or # in the password must be percent-encoded (@ becomes %40), otherwise the string is split in the wrong place.

What a 407 actually looks like

We reproduced the error on a test proxy, shown here with the documentation address 203.0.113.10:8080 and a deliberately wrong user123:pass456. Against an HTTPS site, curl -x http://user123:[email protected]:8080 https://example.com prints curl: (56) CONNECT tunnel failed, response 407. Against a plain HTTP site with -w %{http_code}, curl prints just 407.

Add -v to see whether credentials were sent at all. The trace shows > CONNECT example.com:443 HTTP/1.1, then > Proxy-Authorization: Basic ..., and only then the 407. If the Proxy-Authorization line is missing, your client never sent the login.

The VinaProxy proxy checker reports the same case as auth failed (407). Headless Chrome, which has no login dialog, surfaces it as ERR_TUNNEL_CONNECTION_FAILED; see the tunnel error page.

Fixes by environment

Windows and Chrome: Chrome follows the Windows proxy setting (Settings > Network & Internet > Proxy), which holds only address and port. On the first page load Chrome opens a sign-in dialog for the proxy username and password. If you typed it wrong and the dialog does not return, close every Chrome window and reopen.
Antidetect browsers (AdsPower, GoLogin, GenLogin): keep Host, Port, Username and Password in separate fields. Clear the password field completely and paste it again instead of editing it. Field-by-field help is in the GoLogin setup guide.
Phones: iPhone has an Authentication switch under Settings > Wi-Fi > (i) > Configure Proxy; leaving it off produces a 407. Android usually only accepts host and port, so apps that need a login may show a generic connection error instead.
curl: pass -U "user:pass" separately instead of embedding it in the URL, which sidesteps special-character problems.
Python requests: set http://user:pass@host:port for both the http and https keys of the proxies dict, and encode awkward passwords with urllib.parse.quote.

Credentials are right but the 407 stays

Compare protocols next. VinaProxy sells HTTP(S) proxies with user:pass login and also SOCKS5, so pick the protocol shown on your order in the dashboard. If the checker answers not socks5, that port speaks HTTP and should not be configured as SOCKS5.

Step by step

1
Copy the proxy line from the dashboard
Open the order in your VinaProxy dashboard and copy the full line rather than typing it.
2
Run it through the proxy checker
Paste it into the proxy checker. An auth failed (407) result confirms a credentials problem rather than a network one.
3
Re-enter username and password cleanly
Clear both fields in your software and paste them again with no leading or trailing spaces.
4
Match the protocol to the order
Set the proxy type to HTTP or SOCKS5 exactly as the order states, then save.
5
Trace with curl -v if it persists
Run curl -v with your real values and check for a Proxy-Authorization line before the 407.

Frequently asked questions

Is a 407 caused by my ISP blocking the proxy?

No. The 407 is sent by the proxy itself, so the connection got through. A blocked path shows up as a timeout or a refused connection instead; see proxy timeout.

Why does Chrome keep asking for the proxy login?

Each wrong entry gets another 407 and Chrome asks again. Check Caps Lock and make sure a Vietnamese or other input method is not adding accents to the password.

How do I put a password containing @ into a proxy URL?

Encode it: @ as %40, : as %3A, # as %23. With curl, the -U flag avoids encoding entirely.

Selenium or Puppeteer shows a tunnel error instead of 407. Same problem?

Usually yes. Headless Chrome cannot show a login dialog, so the 407 appears as ERR_TUNNEL_CONNECTION_FAILED. Supply credentials through the library's auth mechanism, as in the Selenium guide.