Glossary · Web tech

TLS SNI

Also calledserver name indicationsni

Definition

TLS Server Name Indication (SNI) is a field in the TLS handshake that names the destination hostname — visible to any network observer even when the connection itself is encrypted.

Explanation

In depth

When your browser opens an HTTPS connection to youtube.com, the very first bytes (the TLS ClientHello) include the destination hostname in plaintext via the SNI field. This is necessary because one IP address can host many HTTPS sites, and the server needs to know which certificate to present. But it also means every intermediate network can see which specific domain you are connecting to, even though the request contents are encrypted. DPI-based blocking uses SNI heavily — the firewall reads the hostname from the ClientHello and drops the connection if the hostname is blocked. Encrypted SNI (ECH) hides the hostname; adoption is still limited in 2026.

Related terms

TLS handshakeThe TLS handshake is the initial exchange between client and server that agrees on encryption keys and verifies the server's identity before any application data flows.DPI (Deep Packet Inspection)Deep packet inspection reads not just packet headers but payload contents to identify and filter specific protocols, applications, or destinations.ESNI / ECHEncrypted Client Hello (ECH) hides the TLS SNI hostname from network observers — the modern replacement for the earlier ESNI proposal.DNSDNS is the internet's address book — it translates human-readable domain names like anyproxy.site into IP addresses computers use to connect.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page