PAC file tester: check your proxy.pac before your users do

A PAC file decides, for every request, whether traffic goes through your proxy or straight to the internet. Small mistakes route traffic around the proxy without anyone noticing. This free online PAC file tester runs your proxy.pac or wpad.dat in the Chromium, Firefox, pacparser or Windows engine profile you choose, traces a URL through it step by step, explains every finding and grades the file from A+ to F.

No PAC file yet? Create one with the PAC file generator, or copy one of the PAC file examples.

PAC file not working?

A broken PAC file rarely shows an error: traffic just goes direct or to the wrong proxy. Paste the file into the tester to find errors in the file itself, then follow the page for what you see:

Before a change goes live, read how to test a proxy.pac file; to make a working file faster, safer and easier to support, read how to optimize and improve a proxy.pac.

Spot the 5 mistakes

This PAC looks reasonable and works in a quick test. It still has five problems that each send traffic past the proxy or slow every request down.

// proxy.pac - sample with 5 deliberate mistakes. Can you spot them?
function FindProxyForURL(url, host) {
  // internal servers go direct
  if (dnsDomainIs(host, "corp.example")) {
    return "DIRECT";
  }
  // partner portal is reachable without the proxy
  if (shExpMatch(url, "*partner.example.com*")) {
    return "DIRECT";
  }
  // private address space goes direct
  if (shExpMatch(host, "10.*")) {
    return "DIRECT";
  }
  if (isInNet(host, "192.168.0.0", "255.255.0.0")) {
    return "DIRECT";
  }
  if (shExpMatch(host, "*.example.net")) {
    return "PROXY proxy.corp.example:8080";
  }
}

Open this PAC in the checker

The mistakes

Line 4: "corp.example" without a leading dot also matches evilcorp.example, so a look-alike domain bypasses the proxy. PAC-X003: dnsDomainIs pattern without a leading dot matches look-alike domains
Line 8: shExpMatch on url instead of host: any URL with "partner.example.com" in its path or query string goes direct. PAC-C001: Hostname pattern applied to url instead of host
Line 12: "10.*" is a text prefix, not a network. It matches the public host name 10.example.com and every 10.x name. PAC-X006: IP range matched as a text prefix
Line 15: isInNet on a host name needs a DNS lookup: the first request to each host waits for it, every request waits when DNS does not answer, and the answer differs inside and outside the network. PAC-P002: isInNet called with a hostname
Line 21: No unconditional return at the end: every other host gets undefined, which browsers treat as DIRECT. Traffic silently bypasses the proxy. PAC-X001: No unconditional return at the end of FindProxyForURL

What the checker does

Parses your file and runs it for your URL and client IP in the engine profile you choose, inside a sandboxed worker in your browser.
Shows a live trace of the path the script took: each test with true or false, each call with its arguments and result, and the line that decided. The quickest way to find out why a URL goes the wrong way; see PAC file troubleshooting.
Annotates your file: an explanation comment above each rule, in plain words, which you can copy or download.
Lets you set what myIpAddress(), DNS lookups and the date and time return, so location- and time-based rules can be tested.
Keeps your file in your browser: it runs in a sandboxed worker on a separate origin, and only the file's logical shape is sent for the grade, with no names, no addresses from your network and no text.
Rates the file A+ to F across errors, security, correctness, compatibility, performance and best practice.
Optionally checks delivery from pasted curl -sI headers.

Reference

The 20 most dangerous PAC mistakes
PAC function reference with per-engine availability
Engine profiles: how Chromium, Firefox, pacparser and Windows differ
WPAD and wpad.dat: discovery and its risks
PAC file statistics: what real proxy.pac files look like

Latest articles

Should you still use a PAC file in 2026? Weaknesses, security and alternatives 15 October 2026
The weaknesses of proxy.pac and wpad.dat, whether a PAC file is secure, when it is still the right choice in 2026, what replaces it, and when to rethink it.
The wpad DNS record: A or CNAME, the block list and the suffix list 13 October 2026
The wpad record exists but WPAD is still not loading? A or CNAME, the Windows DNS global query block list, DNS suffixes and devolution, and lookups that leak.
Flush the PAC cache: what Windows, Chrome, Edge, Firefox and macOS keep 13 October 2026
ipconfig /flushdns does not flush the PAC cache. What WinHTTP, WinINet, Chrome, Edge, Firefox and macOS keep after a PAC or WPAD change, and how to clear each.

All articles

A minimal correct PAC

function FindProxyForURL(url, host) {
  host = host.toLowerCase();
  // internal names and domains go direct
  if (isPlainHostName(host) || dnsDomainIs(host, ".corp.example")) {
    return "DIRECT";
  }
  // default route: always the last statement
  return "PROXY proxy1.corp.example:8080; PROXY proxy2.corp.example:8080";
}

Frequently asked questions

My proxy.pac doesn't work. How do I find out why?

Paste the file into the PAC file tester on this site and press Check. It shows syntax errors, scripts that fail or return nothing, and known mistakes with their line. Enter the failing URL to see step by step which rule decided. If the file is fine, check whether the browser or Windows really uses it; the troubleshooting pages explain how.

Is my PAC file sent to a server when I test it?

No. The file runs in a sandboxed worker in your browser and never leaves it. For the grade, only its logical shape is sent, with no names, no addresses from your network and no text. The shape is kept only if you agree to it when you ask for all findings.

Last updated: 2026-11-01