Free proxies are genuinely useful for casual tasks, but 'free' and 'run by an unknown operator' are the same thing, and that carries real risk worth understanding.
What a proxy operator can see
All your unencrypted traffic passes through the proxy server, meaning whoever runs it can technically inspect, log, or modify it. This is exactly why encrypted (HTTPS) traffic is safer through a proxy than plain HTTP — the proxy operator can't read the contents even though the connection still passes through them.
The worst-case scenarios
A malicious proxy operator could inject ads, redirect you to phishing pages, or attempt to intercept login credentials sent over unencrypted connections. This isn't the norm for most public proxies, but it's a documented risk category, not a hypothetical one.
How to reduce exposure
Stick to HTTPS sites when using an unfamiliar proxy, never log into sensitive accounts (banking, email, work systems) through one, and treat every free proxy as if a stranger were watching your traffic — because, functionally, one might be.