Download (free)
The whole tool is one file, pac-tester-en.html. Nothing to install and no network access, so it works on locked-down work PCs and on machines with no internet connection.
A Japanese version of the tool is also available.
Test FindProxyForURL offline
- Many URLs at once: put one URL per line and get the return value for each (
DIRECT,PROXY host:port; …) in a table - All 14 standard helper functions
- Diff mode: evaluate an old and a new PAC against the same URLs and highlight only the URLs whose result changed
More features
- The host name is taken from each URL for you
- You set the DNS answers (a host-to-IP table), the value of
myIpAddress()and the date and time the script sees - Colour-coded results: each distinct return value gets a colour and a count; click one to filter.
alert()output, errors and timeouts show on the row they belong to. Export to CSV - The 14 helpers:
isInNet,shExpMatch,dnsDomainIs,weekdayRange,timeRangeand the rest (see the guide) - Infinite loops can't freeze it: each URL is cut off after 0.2 seconds
PAC file debugger: what the checks find
The checks parse the script (with acorn) without running it, and point to the line.
What the checks look for
The checks are approximate and will not catch every mistake.
- No
FindProxyForURL, a wrongly capitalised name, the wrong number of parameters, or two definitions - Full-width (CJK) spaces and punctuation, and zero-width spaces, pasted into code. An error in code, a warning inside strings, ignored in comments
- Unbalanced
( ) { } [ ]and unclosed quotes, with the line where they open and where they go wrong - Paths where the function can end without a
return, and return values in the wrong format (,instead of;,"PROXY"with no host, a port out of range) shExpMatchpatterns that can never match, such as".example.com"without*, a scheme in a host pattern, or a URL pattern missing its trailing/- Shadowed rules: an earlier
if (…) return …;whose pattern already covers a later one, so the later rule is never reached - Suspicious helper calls: a non-contiguous
isInNetmask,dnsDomainIswithout the leading dot, lower-caseweekdayRangedays,timeRange(22, 6)
How to use it
- Download pac-tester-en.html and double-click it
- Paste your PAC into the left-hand box, or drag and drop a .pac file onto the page
- List the URLs to test in the right-hand box, one per line. Results and check messages update as you type
On first launch it shows a sample PAC, URL list and host table that use only example domains.
Common questions this answers
How do I test a PAC file without deploying it?
Paste it into the tester and list the URLs you care about. You don't need a web server or a proxy.
How the URL is passed
The tester calls FindProxyForURL(url, host) for each one: host is the host name from the URL, in lower case and without the port. A line without a scheme is treated as http://.
How do I debug FindProxyForURL?
Put alert("…") calls in the script: their output appears on the result row for that URL. Script errors and timeouts also show per URL.
Why does dnsResolve or isInNet behave differently here?
A web page can't do DNS lookups, so the tester uses your host-to-IP table instead. A host that isn't in the table can't be resolved: dnsResolve returns null and isResolvable and isInNet return false.
IP addresses, localhost and IPv6
An IP address in the URL is used as is, and localhost is 127.0.0.1 unless the table says otherwise. Only IPv4 is supported, and Microsoft's IPv6 extensions (isInNetEx, dnsResolveEx and so on) raise an error.
What URL format do I use for a local .pac file?
For this tester, none: open or drop the file. A local file URL looks like file:///C:/proxy/proxy.pac on Windows (RFC 8089, E.2), but Windows' WinHTTP supports only http: and https: PAC URLs.
Why does a path rule not match https URLs?
Chrome and Edge pass only https://host/ to the PAC for https URLs, without the path or query. The tester does the same by default.
Your PAC stays on your machine and runs in a sandbox
pac-tester-en.html never connects to any server. The PAC runs in a Worker inside a sandboxed iframe, separate from the page.
More on safety
- Its Content-Security-Policy blocks network requests as well
- pac-tester-en.html includes everything it needs, including the parser library (acorn). PAC files with internal host names are safe to paste
- A PAC is a program, so it runs separately from the page. It can't touch the page, its storage, or the network
- By default your PAC isn't saved in the browser either (you can opt in)
- pac-tester-en.html contains no ads and no analytics (ads appear only on this page and the guide)
Guide: helper function reference, common mistakes, diff mode, FAQ
By the same author: query Active Directory without RSAT from PowerShell → ADSearch
This is an English translation of the Japanese page. If the two differ, the Japanese version prevails.