AnyProxy

Get Pro
Glossary · Web tech

ESNI / ECH

Also calledencrypted sniencrypted client hello
Definition

Encrypted Client Hello (ECH) encrypts the opening message of an HTTPS connection, hiding the real site name (SNI) from the network; it replaced the earlier ESNI draft.

Explanation

In depth

In classic TLS the browser names the site in readable text at the start of every HTTPS connection. ESNI was a first attempt to encrypt just that name. Its successor, Encrypted Client Hello, encrypts the whole ClientHello. The network sees only a shared outer name that many sites use. The browser learns the encryption key from the site's DNS HTTPS record, so ECH needs browser support, server support, and DNS that the network does not tamper with. Firefox enables it by default from version 119, and Cloudflare made it available on all plans on 29 September 2023. anyproxy.site is one of those sites. On 15 October 2026 its DNS HTTPS record carried an ECH configuration with the outer name cloudflare-ech.com. AnyProxy's regional proxy hosts (sg., fr. and us.anyproxy.site) publish no ECH record, so their names travel in plain text. ECH can also be blocked as a whole. In November 2024 Russia began cutting connections that combine the ECH extension with the name cloudflare-ech.com, saying the technology circumvents restrictions. When that happens the visitor sees a failed connection, not a slower one.

In practice

ESNI / ECH in the real world

Both sides of the ECH story, observed on 15 Oct 2026. The DNS HTTPS record for anyproxy.site includes an ECH config whose public name is cloudflare-ech.com, so an ECH-capable browser would show the network only that name. The record for sg.anyproxy.site has no ECH at all. Cloudflare's trace page, reached through AnyProxy Singapore, reported sni=plaintext: the proxy's onward connection did not use ECH either. Russia shows the limit. Since November 2024 it blocks exactly that cloudflare-ech.com plus ECH combination.

Sources: Cloudflare — Encrypted Client Hello available on all plans (29 Sep 2023) · Mozilla — Understand Encrypted Client Hello · Risky Biz News — Russia blocks Cloudflare ECH connections (Nov 2024) · Cloudflare trace page used in the tests

We checked

ECH on the proxy's onward connection: not used (15 Oct 2026)

Cloudflare trace page opened through AnyProxy Singapore, listing colo=SIN, loc=SG, http=http/2, tls=TLSv1.3 and sni=plaintext, with the IP line hidden

Open Cloudflare's diagnostic page one.one.one.one/cdn-cgi/trace through the Singapore region

Worked · SG exit · 2026-10-15

Page loaded as plain text: colo=SIN, loc=SG, tls=TLSv1.3, http=http/2, sni=plaintext, kex=X25519MLKEM768. The ip= line (the proxy's exit address) was hidden before the screenshot.

Questions about ESNI / ECH

What happened to ESNI?
ESNI encrypted only the SNI field and never became a standard. Encrypted Client Hello replaced it by encrypting the entire ClientHello, which also fixed ESNI's design gaps.
Does ECH hide which site I visit?
It hides the name, not the IP address. Sites sharing a big CDN are hard to tell apart by IP. Sites on their own addresses are not.
Can a country block ECH?
Yes. Russia has blocked Cloudflare ECH connections since November 2024 by matching the shared outer name cloudflare-ech.com together with the ECH extension.

Related terms

TLS SNISNI (Server Name Indication) is the field at the start of an HTTPS connection where your browser names the site it wants, usually in readable text.SNI inspectionSNI inspection is a filtering technique: a firewall reads the site name from the start of an HTTPS connection and cuts or logs the connection if the name is on a list.TLS handshakeThe TLS handshake is the opening exchange of every HTTPS connection, in which browser and server agree on encryption keys and the server proves which site it is.DNS-over-HTTPSDNS over HTTPS (DoH) sends your DNS lookups inside an encrypted HTTPS connection, so the network in between can neither read nor rewrite the answers.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page