VPN or proxy: which one do you actually need?
The difference that matters is how much of your machine goes through the tunnel, and whether DNS goes with it. A practical guide, with the leak that catches most people.
Comparison posts on this usually argue about encryption, and then someone points out that a SOCKS5 proxy can carry TLS perfectly well, and the argument goes nowhere. The distinction that actually changes what you should install is simpler: how much of your computer goes through the tunnel.
A VPN takes the whole device. Every app, every background service, the update checker you forgot about. A proxy takes whatever you point at it, and nothing else.
When device-wide is right
Phones, mostly. On Android there's no practical way to send one app through a tunnel without the system VPN interface, so device-wide is the only sensible design, and it's what we do there. It's also right when you want to stop thinking: you're on hotel Wi-Fi, you want everything covered, you don't want to audit which app is using which path.
The cost is that everything really does mean everything. Your work VPN client, your backup agent, your game launcher. If one of them behaves badly through a tunnel, you'll find out the hard way.
When per-app is right
On a computer, a SOCKS5 proxy is often the better fit, because the useful cases are narrow ones.
- One browser profile that reaches your home bank while the rest of the machine stays local.
- A terminal or a script that needs to look like it is coming from home, without routing your video calls through the same path.
- Testing what a site looks like from another network while you keep working normally.
Per-app also fails more gracefully. If the tunnel drops, the one app you pointed at it stops working. With a device-wide tunnel and no kill switch, everything quietly falls back to your local connection, which is usually the opposite of what you wanted.
The leak that catches people
Point a browser at a SOCKS proxy and it will happily send the traffic through it while asking your local DNS resolver for the addresses. Your ISP, or the café, sees every name you look up. The connection was private. The list of who you were talking to wasn't.
Fixing it means resolving names inside the tunnel. In our client, that's how it works: names are resolved through the tunnel so the exit's own filtering resolver sees them, which is also what makes domain rules possible on the sharing side. In Firefox, the setting to look for is remote DNS with SOCKS5. In Chrome, it depends on how you launch it, which is why we ship a button that opens a browser already configured rather than a paragraph of instructions.
WebRTC is the other classic. A browser can reveal local addresses through it regardless of your proxy settings. If that matters to you, turn it off in the browser.
What SparkUp does on each platform
- Android: a device-wide VPN. No SOCKS listener, because per-app routing there would mean fighting the platform.
- Linux: the same tunnel, plus a local SOCKS5 proxy. Port 1080 by default, and each additional connection takes the next port up.
- Either way the tunnel itself is WireGuard, and DNS is resolved inside it.
- On Linux you can also let other devices on your network use that proxy, which is the cheapest way to get a smart TV or a games console onto the same path without installing anything on them.
There's no iOS app, so if that's your device, neither half of this applies yet.
A short answer
Phone: VPN, because you have no real choice and it's the right default anyway. Laptop, one specific task: proxy. Laptop, general privacy on an untrusted network: VPN with a kill switch. And whichever you pick, check where DNS is being resolved before you trust it, because that's the part that silently doesn't do what you assumed.
SparkUp runs as a VPN on Android and as a VPN or a SOCKS5 proxy on Linux. Early access is open here.