TLS SNI
SNI (Server Name Indication) is the field at the start of an HTTPS connection where your browser names the site it wants, usually in readable text.
Explanation
In depth
One server address often hosts hundreds of HTTPS sites, especially on CDNs like Cloudflare or Fastly. The server has to pick the right certificate before encryption starts, so the browser names the site in its first message, the TLS ClientHello. That name is the SNI field, defined in RFC 6066. In classic TLS it is not encrypted, even though everything after the handshake is. Anyone on the path, such as your ISP, an office firewall or a national filter, can read which site you are opening without seeing any page content. SNI is a field, not a blocking method. Reading that field to block a site is called SNI inspection, a separate term. Encrypted Client Hello (ECH) hides the real name behind a shared public name, but only when both the browser and the site support it. With a web proxy, the SNI your browser sends is the proxy's own host name, for example sg.anyproxy.site. The destination's name appears only on the proxy server's onward connection, outside your network. Our trace test shows that onward connection still sends the destination name in plain text, which is normal for TLS today.
In practice
TLS SNI in the real world
Cloudflare's trace page reports the SNI it received. Opened through AnyProxy's Singapore, Frankfurt and Virginia regions on 15 Oct 2026, it said sni=plaintext every time. So the proxy server's onward connection to one.one.one.one named the site in readable text, visible to the data-centre network, not to yours. The leg from your browser to the proxy names only the proxy host. A TLS check on 15 Oct 2026 found sg., fr. and us.anyproxy.site serve TLS 1.3 with no ECH record, so that proxy host name is readable too.
Sources: RFC 6066 — TLS extensions (SNI) · Cloudflare trace page used in the tests
We checked
SNI as seen by the destination, through AnyProxy (15 Oct 2026)
Questions about TLS SNI
Related terms