Glossary · Web tech

ESNI / ECH

Also calledencrypted sniencrypted client hello

Definition

Encrypted Client Hello (ECH) hides the TLS SNI hostname from network observers — the modern replacement for the earlier ESNI proposal.

Explanation

In depth

SNI has been TLS's largest privacy leak for a decade — every intermediate network sees which domains you connect to. ESNI (Encrypted SNI) was the first attempt to fix this by encrypting the SNI field. ECH (Encrypted Client Hello) is the current standard, which encrypts the entire ClientHello including SNI. Both require server, client, and DNS support. Cloudflare and Firefox have shipped ECH support; Chrome adoption is growing. In censorship-heavy countries, ECH is a major win because SNI-inspection-based blocks stop working. Web proxies are unaffected either way — the SNI your browser sends is for the proxy, and the destination is inside the encrypted body.

Related terms

TLS SNITLS Server Name Indication (SNI) is a field in the TLS handshake that names the destination hostname — visible to any network observer even when the connection itself is encrypted.SNI inspectionSNI inspection is a firewall technique that reads the destination hostname from the TLS handshake and blocks connections to specific domains.TLS handshakeThe TLS handshake is the initial exchange between client and server that agrees on encryption keys and verifies the server's identity before any application data flows.DNS-over-HTTPSDNS-over-HTTPS (DoH) sends DNS queries wrapped in HTTPS — hiding domain lookups from your ISP and network operator.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page