Chrome PAC Files in 2026: Split-Tunnel Proxy Routing with FindProxyForURL
In 2026, managing browser traffic requires more precision than a simple "on/off" switch. For data engineers and multi-account agencies, a Chrome PAC file (Proxy Auto-Configuration) is the professional standard for "split-tunneling", sending specific domains through a proxy while keeping sensitive traffic on your local IP.
While extensions offer a UI, PAC files offer programmable logic that can handle thousands of rules without slowing down your browser.
Pair PAC files with LycheeIP
What is a PAC file and when is it better than a proxy extension?
A PAC file is a JavaScript-based text file containing a single function: FindProxyForURL(url, host). When Chrome is configured with a PAC URL, it executes this function for every single request to decide how to route traffic.
PAC vs. Extension vs. OS Proxy
| Feature | Extension | OS/System Proxy | PAC File |
| Granularity | Per-browser | System-wide | Per-domain/URL |
| Logic | Limited UI rules | Static (On/Off) | Full JavaScript logic |
| Reliability | Can crash/be disabled | Stable but rigid | High stability; automated |
| Failure Mode | Site won't load | Full internet loss | Failover to DIRECT or Proxy B |
The “split-tunnel” benefit
Split-tunneling ensures you only use your proxy bandwidth where it's needed (e.g., scraping https://www.google.com/search?q=target.com) while keeping identity-sensitive traffic (like your email or bank) on your local, trusted IP. This reduces "suspicious login" flags and saves on data costs.
How does FindProxyForURL decide DIRECT vs. PROXY vs. SOCKS?
The browser passes two variables to the function: the full url and the host. The function then returns a string telling Chrome what to do.
Common functions you’ll actually use
- isPlainHostName(host): True if the host has no dots (e.g., http://intranet).
- dnsDomainIs(host, ".lycheeip.com"): True if the host matches the domain.
- shExpMatch(host, "*.target.com"): Uses shell-style wildcards for pattern matching.
- isInNet(host, "10.0.0.0", "255.0.0.0"): Checks if the IP is within a specific range.
Pair PAC files with LycheeIP
Which split-tunnel patterns work best in real workflows?
1. Route only target domains (The "Scraper" Pattern)
JavaScript
function FindProxyForURL(url, host) {
// Only proxy specific target sites
if (shExpMatch(host, "*.example-data.com") || dnsDomainIs(host, "competitor.com")) {
return "PROXY 1.2.3.4:8080";
}
// Everything else stays on my local IP
return "DIRECT";
}
2. Regional routing (The "Geographic" Pattern)
JavaScript
function FindProxyForURL(url, host) {
// Use US Proxy for US-only streaming/news
if (dnsDomainIs(host, ".us-news.com")) {
return "PROXY us-proxy.lycheeip.com:8080";
}
return "DIRECT";
}
How LycheeIP powers advanced PAC routing
For a split tunnel proxy Chrome setup to be effective, the backend IPs must be as intelligent as the PAC script. LycheeIP integrates into PAC workflows by providing:
- SOCKS5 & HTTPS Support: Return "SOCKS5 1.2.3.4:1080" or "HTTPS 1.2.3.4:443" for encrypted, high-speed tunnels.
- Sticky Session Control: Maintain the same IP for specific domains by targeting LycheeIP's static residential endpoints in your script.
- High Throughput: LycheeIP datacenter proxies support 1Gbps+, ensuring that even if your PAC file routes heavy traffic, your browser won't lag.
- Failover Reliability: With 99.8% uptime, your "DIRECT" fallback in the PAC script is rarely needed.
How do you write a PAC file for multiple providers?
You can chain proxies for high-availability setups. If the first proxy fails, Chrome automatically tries the second.
Provider pools and failover rules
JavaScript
function FindProxyForURL(url, host) {
if (dnsDomainIs(host, "scraping-target.com")) {
// Try LycheeIP first, then fallback to secondary, then go DIRECT as a last resort
return "PROXY pr.lycheeip.com:8080; PROXY backup.provider.com:8080; DIRECT";
}
return "DIRECT";
}
Pair PAC files with LycheeIP
How do you deploy a PAC file for Chrome reliably?
Hosting options
- HTTPS URL (Recommended): Host your .pac file on a secure server (e.g., GitHub Gists or an S3 bucket). Set the MIME type to application/x-ns-proxy-autoconfig.
- Local File: Chrome has restricted file:// access for PAC files in recent years. In 2026, it is highly recommended to use a local web server or a Data URL for testing.
Managed deployment
For organizations, use Chrome Enterprise policies to force a PAC URL on all employee browsers. This ensures compliance and prevents users from accidentally disabling their security routing.
How do you test and debug PAC decisions fast?
A PAC file not working Chrome error is usually silent. To see which rule is actually firing, use Chrome NetLog.
- Navigate to chrome://net-export/.
- Start logging to disk and reproduce the issue.
- Upload the log to the NetLog Viewer.
- Search for PROXY_SCRIPT_DECIDER events to see the exact return value for a specific URL.
Typical Bugs to Avoid
- DNS Latency: Functions like dnsResolve() can slow down browsing because Chrome must wait for a DNS response before routing.
- Case Sensitivity: Hostnames are usually lowercase, but it's safer to use .toLowerCase() in your logic if doing complex string matching.
Assumptions & Limitations
- No Authentication: PAC files cannot provide proxy usernames/passwords. You must use IP whitelisting or wait for the browser's auth prompt.
- JavaScript Sandbox: PAC scripts run in a restricted environment; you cannot use alert() (in most modern versions) or access cookies/DOM.
Pair PAC files with LycheeIP
Frequently Asked Questions
- How to deploy a PAC URL in Chrome?
Go to chrome://settings/system > "Open your computer's proxy settings." Enable "Use setup script" and paste your PAC URL. - What is a FindProxyForURL example for SOCKS5?
Return "SOCKS5 1.2.3.4:1080; DIRECT". This tells Chrome to use SOCKS5 first, then go direct if the proxy is down. - Why is my PAC file not working in Chrome?
Check for syntax errors (missing semicolons) or an incorrect MIME type on your hosting server. Use chrome://net-export/ to find the specific error. - Can I use a local file for a Chrome PAC?
Standard Chrome blocks file:// paths for PAC for security. Use a local HTTP server or a secure HTTPS link. - How do I bypass a specific site in a PAC file?
Use if (dnsDomainIs(host, "bank.com")) return "DIRECT"; at the very top of your function. - Does a PAC file work with VPNs?