Should you still use a PAC file in 2026? Weaknesses, security and alternatives
Yes, in the right places. Every current browser and operating system still reads PAC files, and for proxies inside your network, for devices where no extra software can be installed and for browser traffic they are still the simplest tool. On company laptops that work from anywhere, the security vendor's agent is usually the better way. This page explains the weaknesses that every PAC file has, whether it is secure, and what the alternatives cost.
A PAC file (proxy auto-configuration file) is a small JavaScript program that tells the browser, for every address, whether to use a proxy and which one (what a PAC file is). It is often called proxy.pac, or wpad.dat when clients find it on their own through WPAD. This page is for the administrator who wonders whether the method is still right, often after a vendor has suggested replacing it. How to make a file better is a different question; the page of best practices answers it.
What is wrong with PAC files?
Five weaknesses come with the method itself, so even a well-written file has them. Mistakes in a particular file are a separate matter; the 20 most dangerous PAC mistakes list them with fixes.
- A PAC file fails open. “Fail open” means that an error lets traffic through instead of stopping it. When the function throws an error or returns no usable answer, Chrome, Edge and Firefox connect directly, without any message to the user (source: code, Chromium and Firefox 157, checked 2026-10-04). Windows programs that use the system’s proxy settings get an error instead of an answer (source: lab, Windows 11, 2026-10-11). This is not a rare case: about a third of the files checked with this site’s tester do not parse at all, and in about 38% of the others the script fails or returns an invalid answer for some addresses (PAC file statistics, the 20 most dangerous mistakes).
- The engines do not agree. The same file can give different answers in Chrome, Firefox and Windows.
Chrome removes the path of
https://addresses before the script sees them, and Firefox removes it for every address. Windows reads the returned text loosely, so a missing semicolon beforeDIRECTsends the traffic direct, anddateRange()andtimeRange()are always false there (source: lab, Windows 11, 2026-10-11). The engine differences table has the full list with sources. A file therefore has to be tested in every engine your users run, not just once. - DNS can decide the route. Functions such as
isInNet,dnsResolveandisResolvablelook up a host name. Only the first request to a name waits for the lookup, because the engines cache the answer. When DNS does not answer, every request waits, about 12 seconds per call in Windows programs (source: lab, 2026-10-14). The page on DNS in PAC files shows how to avoid it. - A fix takes time to reach every client. Chrome, Edge and Firefox fetch the PAC file without the browser’s HTTP cache. Chromium reloads it after a change of IP address and checks a working script every 12 hours; Firefox reloads after a network change and has no timer (source: code, checked 2026-10-13). A corrected file can therefore need hours to reach everyone, unless users restart their browsers. The page on resetting the PAC cache explains what each client keeps.
- Nobody sees which route a client took. A PAC file is JavaScript written by hand, often copied from an older file, and it runs on every client separately. The proxy logs only the requests that reached it. A request that the file sent direct, by intent or by mistake, leaves no trace there. Three in four of the files that parse get a grade of C or worse in this site’s tester (PAC file statistics), and most of these problems never cause a visible error.
Is a PAC file secure?
A PAC file is not a security control. It decides where traffic goes, and it can be ignored. It is secure enough for that job only if you control who can change it and how it reaches the clients.
- Any program can ignore it. A PAC file is a request, not a rule. Programs with their own network settings, command-line tools and anything a user starts with other settings can connect directly, and a user with administrator rights can switch the setting off. So the firewall at the edge of your network must let web traffic out only from the proxies. Then a broken or ignored PAC file shows up as an error, not as open access to the internet.
- Whoever controls the file controls the route. A changed PAC file can send every request through a
proxy of the attacker’s choice. That proxy sees every plain
http://request in full and, forhttps://, the names of the sites visited; it cannot read encrypted content unless the client trusts a certificate the attacker controls. Serve the file over HTTPS from a server you own (PAC-D001), keep it in version control and limit who may change it. - Browsers limit what a hostile file can read. Chrome and Edge remove the path and query of
https://addresses before the script sees them, since Chromium 52 (source: code). Firefox removes the path of every address (source: lab, Firefox 157, 2026-10-12). So the script sees which host you visit, but not secret parts of an encrypted address such as a token in the path. The table per engine is on the FindProxyForURL page.
A wpad.dat that clients find on their own through WPAD (Web Proxy Auto-Discovery) is less safe than a PAC address that you configure, because the discovery uses plain HTTP and DHCP and DNS answers that nobody checks. The WPAD page answers whether WPAD is secure.
Should you still use a PAC file in 2026?
Yes, where traffic should go to explicit proxies and the device cannot or need not run an agent. No, as the main way to send traffic from company laptops that work from anywhere. An agent is software from the security vendor, installed on each device, that sends its traffic to the vendor’s proxies.
| Situation | Use a PAC file? | Why |
|---|---|---|
| Proxies inside your own network, several of them with failover | Yes | This is what PAC files were made for: internal names direct, the rest to a first and a second proxy |
| Devices where no agent can be installed: servers, kiosks, virtual desktops, guest devices, laptops of other companies | Yes | The PAC address is only a setting; nothing has to be installed |
| Only browser traffic needs to reach the proxy | Yes | Browsers read PAC files reliably |
| Moving from one proxy or vendor to another | Yes, during the move | One file can send some sites or some groups of users to the old proxy and the rest to the new one |
| Company laptops that work at home, on the road and in the office | Usually no, as the main way | A PAC file covers only programs that read it, fails open, and a file hosted inside the company cannot be loaded from outside unless it is published or hosted by the vendor |
| Laptops that find the file through WPAD on other networks | No | Outside your network, someone else’s network answers the WPAD lookup (the WPAD page) |
The reason for the verdict on laptops is simple. An agent sends the traffic of every program, not only the traffic of programs that read the proxy setting, and it works the same in the office and outside. A PAC file does neither. This is not a recommendation of any vendor: the same holds for every agent, and an agent has weaknesses of its own, which the next section lists.
What replaces a PAC file?
Four alternatives, and none of them is free of problems. They move the routing decision to another place; they do not remove it.
| Alternative | What it does | Its own weakness |
|---|---|---|
| The vendor’s agent | Catches traffic on the device at the network level and sends it to the vendor’s proxies | Must be installed and kept up to date on every device. It needs its own list of exceptions, which several products write in the same PAC syntax. A DIRECT in a browser PAC file does not get past it (PAC-B014) |
| A tunnel from the site | A router sends all traffic of an office to the vendor through GRE or IPsec, two common ways to wrap traffic for another network | Covers only devices at that site, not laptops at home |
| A fixed proxy with an exception list | The manual proxy setting with a list of addresses that go direct | Cannot choose between proxies by destination, and cannot fall back to a second proxy. While a PAC file is set, the manual exception list is ignored (what a PAC file is) |
| Transparent interception | A network device redirects web traffic to the proxy without any setting on the client | Works only where traffic passes through that device, and the proxy cannot ask the browser to log in the way an explicit proxy can |
Many organisations combine them: an agent on managed laptops, a tunnel for each office, and a PAC file for everything that cannot run the agent. If your proxies are a cloud service, a security service edge (SSE), the page on PAC files with an SSE explains how a PAC file and the vendor’s agent work together and has a builder for each vendor.
When should you rethink your PAC file?
When the file has become hard to explain, or when it no longer matches how people work. These signs mean it is time to look at it again:
- The list of exceptions is long, and nobody knows why some of them are there.
- The file calls
isInNet,dnsResolveorisResolvableon host names on the way to most requests. - Blocks were copied from a vendor template that no longer fits your network.
- The file has grown past a few hundred lines (PAC-P006).
- Chrome and Windows programs give different answers for the same address.
- Most users now work outside the office, but the file still assumes the company network.
Rethinking can mean two things. Either the file stays and gets cleaned up, which the page of best practices describes point by point, or the traffic moves to one of the alternatives above and the file shrinks to the devices that still need it. In both cases, paste the current file into the PAC file tester first: its findings show which of these signs your file has.
Frequently asked questions
Is a PAC file a security control?
No. It decides routing and can be bypassed by any user or program that ignores it. Enforce policy at the egress firewall, so that only the proxies may connect to the internet, and treat the PAC file as a convenience that must fail safely.
Are PAC files deprecated?
No. Chrome, Edge, Firefox, Safari, Windows and macOS all still read PAC files in 2026, and the vendors of cloud security proxies still document them. The format was never a formal standard; it goes back to Netscape in the 1990s. What has changed are details, for example that Chrome no longer loads a PAC file from a file path and that browsers hide the path of https addresses from the script.
Do SSE vendors still support PAC files?
Yes. Zscaler, Netskope, Skyhigh Security, Cloudflare and Palo Alto Networks (Prisma Access) all document PAC files for their cloud proxies, and several of them host the file for you. Their agents use PAC files too, for example for their own bypass lists. The builders at findproxyforurl.net/generate/sse/ follow each vendor's documentation.