The short answer
CONNECT is a special HTTP request: CONNECT example.com:443. It tells the proxy, "open a TCP connection to this host and then just pass bytes back and forth". Once the proxy replies 200, your browser runs its normal encrypted TLS handshake straight through the tunnel.
Why it matters
Because the traffic inside the tunnel is encrypted end to end, an ordinary HTTP proxy can carry HTTPS websites without being able to read them. It sees which host and port you connected to, but not the pages, passwords or cookies.

Also known as
HTTP tunnel, CONNECT tunnel, HTTPS proxy tunneling.
Learn more
- HTTP vs HTTPS proxies
- How proxies work
- Does a proxy encrypt my traffic?
- What is ERR_TUNNEL_CONNECTION_FAILED?
- MDN on the CONNECT method
- RFC 9110, HTTP semantics (section 9.3.6)
- RFC 8446, TLS 1.3
- How Let's Encrypt certificates work
Editorial note: Proxy providers change their pools, features and prices often, so treat any figures here as typical ranges at the time of writing and confirm current terms with the provider before you buy.