How to Configure a System‑Wide Proxy Auto‑Config (PAC) File on Android (No Root)

Before you start

Configuring a Proxy Auto‑Config (PAC) file lets you define flexible proxy rules—such as directing only certain domains through a proxy while letting the rest go direct. Android supports PAC files for Wi‑Fi networks, but the feature is hidden in the Advanced proxy settings. The steps below work on Android 9 (Pie) and newer; older versions may lack the Auto proxy option.

• Wi‑Fi connection: The PAC file can only be applied to a specific Wi‑Fi network. Cellular data requires a VPN‑based solution, which is outside the scope of this guide.
• Trusted proxy: Using an untrusted proxy can expose your traffic. Only use a proxy you control or a reputable service.
• Backup: Changing network settings is safe, but if you plan to modify the PAC file later, keep a copy of the original file.
• Internet access: You need a working Wi‑Fi connection to download the PAC file or host it locally.

Step‑by‑step setup

function FindProxyForURL(url, host) {
    // Bypass the proxy for internal sites
    if (dnsDomainIs(host, ".example.org")) {
        return "DIRECT";
    }
    // All other traffic goes through the proxy
    return "PROXY proxy.example.com:8080";
}

adb shell settings get global http_proxy

Troubleshooting

• PAC file not reachable: Ensure the URL is reachable from the device (open it directly in the browser). A 404 or DNS error will cause Android to fall back to DIRECT for all traffic.
• Syntax error in PAC file: Even a missing semicolon can break the entire file. Test the PAC file in a desktop browser (Chrome/Firefox support PAC URLs) before applying it to Android.
• Proxy not applied to some apps: Android’s system proxy only affects apps that respect the system settings. Some VPN or security apps may override it. If an app still bypasses the proxy, check its own network settings.
• Changing Wi‑Fi networks resets the proxy: The PAC configuration is tied to the specific SSID. You must repeat the steps for each Wi‑Fi network you want to use the proxy on.
• Cellular data: Android does not support PAC for mobile data natively. To apply the same rules on cellular, you would need a VPN app that accepts a PAC file (e.g., “OpenVPN for Android” with a custom script) – outside the scope of this guide.

Safety and privacy considerations

Using a proxy routes all your HTTP/HTTPS traffic through a third‑party server. Even though the PAC file itself does not encrypt data, the underlying connections are still protected by TLS when you visit HTTPS sites. However, the proxy can see the domain names of encrypted connections (via SNI) and the full request URL for unencrypted sites. Only use proxies you trust, and consider adding certificate pinning or a VPN if you need end‑to‑end privacy.

Alternative methods

• Third‑party apps: Apps like “ProxyDroid” (requires root) or “Every Proxy” (no root, uses VPN interface) can apply PAC rules system‑wide, including for cellular data.
• VPN with PAC support: Some VPN clients allow you to import a PAC file and then split‑tunnel based on those rules. This gives you the same flexibility on both Wi‑Fi and mobile data.

With the steps above you now have a functional system‑wide PAC configuration for your Android Wi‑Fi network, without needing root access. Adjust the PAC rules as your needs evolve, and always verify that traffic is flowing through the intended proxy.