PAC file tester
Run a proxy auto-config file against any URL in your browser, see the return value, every helper call it made, and which of those calls cost you a DNS lookup.
Evaluate a PAC file
What this tool does#
A PAC file is a JavaScript function, FindProxyForURL(url, host), that every request in a browser or a PAC aware client passes through. It has no test framework, no error reporting to speak of, and when it is wrong the symptom is "the internet is broken for some sites" with no log to read.
This tool evaluates your PAC file against a URL and shows three things: the string it returned, how a client will interpret that string, and the ordered list of every helper function the file called. The helper trace is the part you cannot get anywhere else, because it exposes the two problems that make PAC files slow and leaky.
Why the helper trace matters#
Helpers fall into two classes with very different costs.
| Helper | Cost | Notes |
|---|---|---|
isPlainHostName | free | pure string test on the host |
dnsDomainIs | free | suffix comparison |
localHostOrDomainIs | free | string comparison |
shExpMatch | free | glob against the URL or host |
dnsDomainLevels | free | counts dots |
myIpAddress | cheap, cached | can return a VPN or loopback address depending on client and platform |
dnsResolve | blocking DNS lookup | happens before the request starts |
isResolvable | blocking DNS lookup | same cost |
isInNet with a host name | blocking DNS lookup | resolves the name first |
Every blocking lookup happens on the critical path of the very first byte of the request, and it happens for the hostname of a site the user has not connected to yet. That means two things at once: added latency on every navigation, and the hostname being sent to your DNS resolver even for traffic that was going to be proxied and therefore never needed local resolution.
Return value syntax#
FindProxyForURL returns a string of semicolon separated entries, tried in order.
| Entry | Meaning | Support |
|---|---|---|
DIRECT | connect to the origin, no proxy | universal |
PROXY host:port | HTTP proxy | universal |
HTTP host:port | same as PROXY | Chromium |
HTTPS host:port | proxy reached over TLS | Chromium and current Firefox, not universal |
SOCKS host:port | SOCKS4 | widely supported |
SOCKS5 host:port | SOCKS5 | Chromium and Firefox |
Two details catch people. A missing port is not portable, because clients disagree about the default. And whether you end the list with DIRECT is a policy decision: with it, a total proxy outage degrades to unproxied internet access, which may be exactly what your security team forbids. Without it, a proxy outage is a full outage.
Frequently asked questions#
How do I test a PAC file without deploying it?#
Paste it above and evaluate the URLs you care about, including the awkward ones: a bare hostname, an internal name, a public name, and a name that resolves into private address space. The batch button runs a standard set in one go.
Why does my PAC file work in Chrome but not in a command line tool?#
Most command line tools do not support PAC at all. curl, pip, apt and the Go standard library read http_proxy, https_proxy and NO_PROXY environment variables and ignore PAC entirely, so a PAC only rollout leaves every non browser client unconfigured. You need both, and they need to agree.
Can FindProxyForURL see the path of an HTTPS URL?#
No. For https:// requests, clients pass only the scheme, host and port in the url argument. Any rule you write against the path silently never matches for HTTPS, which today is nearly everything.
Is the tool running my PAC file on a server?#
No. It is evaluated in your browser, in a sandbox where the PAC helper functions are supplied by this page, and dnsResolve answers from the map you provide rather than doing any real lookup. Nothing leaves your machine.
What happens if the PAC file throws an exception?#
Behaviour varies by client. Some fall back to DIRECT, some fall back to no proxy configuration at all, and some retry. None of them tell the user. That is why a syntax error in a PAC file tends to present as an intermittent, unexplained outage rather than an error message.
Primary sources#
Every normative claim on this page is checked against the specification or the vendor documentation listed here. Where behaviour is version dependent, the version is named in the text.