Smartproxy (Decodo) Review: Proxies for Web Scraping Tested

Type smartproxy.com into a browser on 13 August 2026 and you never see a Smartproxy page. The server answers 302 and hands you to decodo.com. The name went first, in April 2025. The product moved a long way afterwards: new scraping APIs, an MCP server, a published thread-limit policy, and a restricted-target list that rules out several of the jobs older reviews still recommend this network for.

Everything below was read from Decodo's own pricing pages, documentation, legal pages and GitHub organization on 13 August 2026. Where the vendor is the only source for a number, that is stated.

Three claims in the earlier version of this review did not survive the recheck. Sticky sessions are not capped near 30 minutes. Concurrency is not unlimited across the product line. And the anti-detect browser it listed among the toolkit no longer exists.

What the rebrand changed, and what it did not

The vendor's own transition page dates the move precisely. It "officially began in early 2025 with the official release on April 22nd." The reasoning given is expansion rather than trouble: users who arrived for account management stayed for scraping and, in the company's words, "advanced use cases, such as AI training."

What stayed put matters more than the logo. Logins carried over. Subscriptions, pricing and renewal terms carried over. Billing details did not need updating. Most usefully for anyone with old code in production, Decodo states that Smartproxy endpoints and URLs "will continue working indefinitely." New integrations use gate.decodo.com:7000 for residential traffic.

What changed is the surface. The company operates only under decodo.com and decodo.cn now, replacing smartproxy.com and the Chinese smartdaili.cn. The dashboard lives at dashboard.decodo.com. Decodo also publishes a warning worth repeating: smartproxy.org and smartproxy.cn are impersonators with no connection to the company. A rebrand leaves an abandoned brand name lying around, and somebody usually picks it up.

The legal entity is checkable. The privacy policy, last updated 27 October 2025, names UAB "Data troops", legal entity code 305893779, Švitrigailos str. 34, Vilnius, Lithuania. Ownership above that entity is not published anywhere on the site, and no filing obliges it to be. That is the boundary of what a buyer can establish from outside.

The pool, and how much of it you can check

Decodo advertises 125M+ IPs across 195+ locations, split as 115M+ residential, 10M+ mobile and 500K+ datacenter addresses. Its performance claims are 99.92% success rate, under 0.5 seconds average response time, and 99.99% uptime.

Every one of those figures is vendor-reported. No proxy network publishes an audited pool count and no outsider can produce one. Treat pool size as a marketing unit, not a specification.

The per-country breakdown on the features page is more useful than the headline, because it is the number that decides whether targeting works. India shows 9.4M+ addresses, the United States 7.1M+, Germany 2.3M+, the United Kingdom 1.7M+, Canada 540K+, Japan 104K+. City and ASN targeting on a 7-million-address pool is a different product from city and ASN targeting on 104 thousand. Ask for the country count before you plan a localised crawl, not after.

Targeting itself is generous and, unusually, unmetered: continent, country, state, city, ZIP code and ASN, at no extra cost. Rivals still charge for city-level or reserve it for higher tiers.

Protocol support is complete. HTTP(S) and SOCKS5 on every proxy type, which retires the "no SOCKS5" complaint that older roundups still carry. SOCKS5 is worth choosing deliberately rather than by habit: RFC 1928, a Proposed Standard from March 1996, is what gives you UDP relaying through UDP ASSOCIATE and username/password negotiation. An HTTP proxy gives you neither.

Prices, read on 13 August 2026

Rate cards move without announcement. These were read from the vendor's own pricing pages on the date above.

The Web Scraper API has a genuinely free tier: 2,000 requests a month on standard proxies, 1,000 with JavaScript rendering, rate-limited to 10 requests per second. Rendering and premium proxies cost multiples of the base rate. On the $99 Business plan a standard request is $0.14 per 1,000 and a premium request with JavaScript is $1.20 per 1,000, roughly a factor of nine for the same URL.

Proxy trials are thinner than the marketing suggests. The residential offer is a 3-day free trial capped at 100 MB, backed by a 14-day money-back guarantee that explicitly excludes trial users who have burned more than 20% of their plan. One hundred megabytes is enough to prove that authentication works and not much else.

Against the rest of the market

Residential list prices for the same unit, all read on 13 August 2026:

Decodo is cheapest at the point where most projects actually start, and mid-pack at the top. Entry rates cluster between $3.50 and $7.00, and the spread only opens at terabyte volume, where nobody pays list anyway. Bright Data's numbers, and its mandatory identity check for residential traffic, sit in our NetNut writeup.

Traffic expiry is the term that decides real cost for irregular workloads, and it is the one comparison tables leave out. IPRoyal advertises residential traffic that never expires. Decodo advertises no equivalent rollover on its monthly plans, so read the renewal terms before committing to a 100 GB tier you will consume unevenly. Buy for the month you actually have, not the month you are planning.

What a gigabyte actually buys

Bandwidth billing is the part that surprises teams, and Decodo's traffic documentation is unusually explicit about what it counts. Billable bytes include "all headers, cookies, and POST data" going out, and "every byte received from the target website, including response headers and cookies" coming back. HTTPS adds the tunnelled bytes of the TLS handshake. Non-200 responses from the target count in full: 403, 404, 503, all of it. Only Decodo's own failures, 502s and connection errors raised by the proxy, are excluded.

Run the arithmetic before you commit to a plan.

A modest HTML page of 50 KB, plus about 2 KB of request and response headers, costs roughly 52 KB per fetch. A million of those is about 52 GB. At the 100 GB rate of $2.75/GB that is around $143, except you cannot buy 52 GB at the 100 GB rate, so the honest figure is the 50 GB tier at $3.00/GB and a second top-up.

Now render the same million pages in a headless browser without blocking anything. A page that pulls images, fonts and third-party scripts runs to 2 MB. That is about 2 TB of billed traffic, or roughly $5,500 at the same per-GB rate. The block list in your browser automation is worth more than any discount you will negotiate. Requesting only the document, killing images and fonts, and stripping cookie headers you do not need moves the invoice by more than an order of magnitude.

Failure rates compound directly, because failures are billed. A crawl that gets 403s on 20% of requests and retries each one pays for both attempts. Twenty per cent block rate is a 20% surcharge on the whole run, on top of the delay. That is the arithmetic behind the advice to fix your request profile before you buy more bandwidth. Our proxy speed benchmark walks through measuring the latency side of the same trade-off.

Sticky sessions: 24 hours, requested not guaranteed

The earlier version of this review said sticky sessions ran "historically up to around 30 minutes." That was wrong on 13 August 2026 and probably wrong when it was written. Decodo's session documentation sets the sessionduration parameter anywhere from 1 to 1,440 minutes, a full 24 hours. The dashboard offers presets of 1, 10, 30 and 60 minutes, which is likely where the 30-minute number came from.

The caveat the docs attach is the honest part, and it is the reason not to design around a 24-hour session: "The longer the session you have, the more chances there are that the IP will rotate before your specified time due to the residential device at the end going offline." A residential exit node is somebody's phone or laptop. It leaves.

A long sticky session is a request, not a contract. Code that assumes an unchanging IP for a day will break on a Tuesday afternoon for reasons no log explains. If you need a stable address for hours, buy static residential, where Decodo advertises unlimited-duration sessions across 17 countries. Rotation is per request on the rotating endpoint, and you can force an early one by changing the port or the session ID.

Concurrency has a published ceiling

Older write-ups, this one included, said Decodo bills on traffic rather than threads and lets you scale concurrency freely. That is true of residential, where no thread-limit document exists and none of the pricing bullets mention a cap. It is not true of the per-IP products, and the numbers are specific.

On ISP pay-per-IP you choose 1,000 threads at the standard price or 5,000 threads for an extra 20% of the plan price. Datacenter pay-per-IP offers the same two options, with the 5,000-thread tier costing an extra 40%. Threads are divided equally among your sub-users, so 5,000 threads split across five sub-users gives each of them 1,000.

Then there is the fair usage policy, which triggers when two conditions are both met: total traffic above 10 TB in a subscription period, and traffic above 25 GB on any single IP. Cross both and "concurrent sessions will be reduced from 5000 threads to a limit of 10" for the remainder of the period. The per-IP threshold scales, so 1,000 IPs means 25 TB before the policy can bite, but the consequence does not scale at all.

Ten threads is not a degraded service. It is a stopped crawl.

Spread load across IPs rather than hammering a favourite, and watch per-IP consumption as a first-class metric. The reset comes only with the next subscription period.

Targets Decodo will not proxy

Price and pool are irrelevant if the vendor blocks your target category outright, and this is the check most reviews skip. Decodo's restricted-target documentation and its ethical usage policy rule out banking and financial activity including cryptocurrency financing, government sites, entertainment and streaming with Netflix named explicitly, the Apple and Google app stores, ticketing, gaming, mailing and telecommunications. Several categories, among them mailing, streaming and business targets, are unblockable on rotating residential only after ID verification. Mobile proxies carry further limits on top.

That list retires a recommendation the previous version of this article made. Sneaker and ticketing sites were offered there as a natural fit for the residential pool. Ticketing is on the restricted list. The advice was generic proxy-review boilerplate, and it did not survive contact with the vendor's own policy.

Identity checking applies to buyers as well as targets. The privacy policy describes verification through Stripe Identity using a government-issued ID and a selfie compared by biometric facial recognition, with a company path that takes a registration number and website instead. Results are retained for the contract term plus five years. If anonymous purchase is a requirement, this is not your vendor, and after the year this market has had, that requirement is worth examining rather than defending.

The sourcing question, after the year residential proxies had

Where residential IP addresses come from stopped being a philosophical question in 2026.

On 28 January 2026 Google's Threat Intelligence Group published its disruption of the IPIDEA network, describing one operator behind thirteen separately branded storefronts, four bandwidth-sharing SDKs, over 600 Android applications and roughly 7,400 second-tier servers, with more than 550 distinct threat groups seen using its exit nodes in a single week. In July the same team turned to NetNut, and the aftermath, including the seizure banner and the SEC filings, is documented in our NetNut review.

Neither report names Smartproxy or Decodo. That is a real fact and a limited one. It means this vendor has not been publicly implicated. It does not mean anyone outside the company has verified the consent chain behind 115 million residential addresses, because nobody can.

What Decodo does publish is a sourcing and usage policy stating that it partners with providers who verify willing participation, obtains explicit consent before traffic is shared, pays peers by the gigabyte, and lets them stop. It holds an ISO/IEC 27001:2022 certificate covering its proxies and Scraping API, and it describes itself as a co-founder and accredited holder of the EWDCI Certified designation. Decodo is listed among the members on ethicalwebdata.com alongside Oxylabs, Zyte, Coresignal, Rayobyte, Evomi, Proxyrack, ProxyEmpire and Byteful. The initiative's most recent item, dated 9 July 2026, is a statement on ethical standards in the residential proxy industry, published a week after the NetNut seizure banner went up.

Here is where the knowledge stops. Decodo does not name the partner applications that supply its residential pool, which is the single piece of information that would let a buyer judge the consent claim. The ISO certificate and a dashboard penetration-test report are referenced on trust.decodo.com as downloadable documents behind a request flow, so no certificate number, auditor name or expiry date is publicly visible. A designation you cannot open is a claim, not evidence.

Three things a buyer can actually check on any residential vendor, and Decodo passes all three: it has not been named in a takedown, it publishes an identifiable legal entity, and it gates sensitive product categories behind identity verification. That is a lower bar than an audit. It is also the highest bar the market currently offers, and it is more than most storefronts clear. If sourcing risk is the deciding factor for you, the honest alternative is to stop buying residential exit nodes and take the data as a finished dataset instead, where the collection method is somebody else's contractual problem.

What is new since this review was written

The proxy business is now the smaller half of the product. Decodo sells a Web Scraper API with pre-built templates, a Fast Search API from $0.40 per 1,000 requests, an AI Parser, a video downloader, and Site Unblocker, which takes a URL and returns rendered HTML with fingerprinting and challenge handling included from $0.95 per 1,000 requests.

The agent tooling arrived in 2026 and is under active development, which is checkable rather than claimed. The GitHub organization shows an MCP server updated 1 July 2026, a command-line client on 3 July 2026, and a TypeScript SDK on 26 June 2026. The MCP server exposes scrape_as_markdown, google_search_parsed, amazon_search_parsed and Reddit post and subreddit tools, works with any MCP client, and comes with a trial of 1,000 requests over seven days. Star counts are in the low tens, so treat this as early rather than proven.

Something also disappeared. The X Browser anti-detect browser this review once listed among the helper tools is gone; that URL now redirects to the homepage, and decodo.com/apps lists exactly three free tools: a Chrome extension, a Firefox add-on and a bulk proxy checker. Decodo now documents integrations with third-party anti-detect browsers rather than shipping one. Service state is published at status.decodo.com, all operational on the date of this recheck.

Where it fits, and where it does not

The dashboard remains the strongest argument for this vendor. Choosing a location and a session type from dropdowns and pasting the generated endpoint into a scraper takes minutes. Whitelisting, sub-users and per-user traffic limits are a couple of clicks, and every dashboard action has an API equivalent. Support answers around the clock.

Against that:

• Bandwidth billing punishes inefficient scrapers. See the arithmetic above. A headless browser with default settings can multiply your bill by forty.
• The trial is 100 MB. Enough to test connectivity, not enough to test block rates on a real target.
• Per-IP products have a hard fair-usage cliff at 10 TB combined with 25 GB per IP, and the landing is ten threads.
• Targeting granularity is only as good as the country pool behind it, and some countries are thin.
• Restricted categories are broad enough to disqualify entire projects before pricing matters.

Proxies alone still do not defeat modern defences. Sensible request pacing, realistic headers, a headless browser where the target needs one, and often CAPTCHA handling all sit on top. Rotation is one layer in a wider anti-blocking strategy: route every request through a fresh IP while keeping an obviously robotic fingerprint and you get flagged anyway. For the mechanics of wiring rotation into a crawler, our walkthrough of rotating residential proxies covers the integration, and the comparison of free and paid pools covers why the free option is not one. If your requirement is a small block of private datacenter IPs rather than a rotating pool, the economics look different again, as our SquidProxies review shows.

The verdict

Smartproxy under its Decodo name is still a sensible default for mid-sized scraping work: competitive at the volumes where projects begin, unmetered targeting, complete protocol support, 24-hour sticky sessions when the exit device cooperates, and a control surface that does not require a sales call. The 2026 additions, particularly Site Unblocker and the scraper APIs, are priced to compete with dedicated unblocking vendors rather than as afterthoughts.

It is not the cheapest at scale, the 100 MB trial is too thin to prove anything about your targets, and the per-IP fair-usage cliff deserves a line in your capacity plan. The larger question is one no proxy review could dodge this year: you are buying access to other people's home connections, and the only assurances available are the vendor's own. Decodo's are more detailed than most and still unverifiable from outside.

Budget by bandwidth rather than thread count, block every byte you do not need, and price alternatives on how much of the pipeline they remove. When rotation, unblocking and parsing have quietly become the project, handing the collection layer to a managed extraction service beats buying the next tier of gigabytes. Our guide to choosing a proxy network covers the cross-vendor comparison, and our breakdown of residential pool economics covers the units they are sold in.

Prices, limits and policies in this review were read from Decodo's own pricing pages, documentation and legal pages on 13 August 2026. Rate cards and restricted-target lists change without notice, so confirm current details with the provider before buying. We have no commercial relationship with Decodo.