ENCRYPTED CLIENT HELLO CHECKER
ECH Checker
Test Encrypted Client Hello
Is your hostname staying private?
Go beyond DNS. Verify that your domain really negotiates
Encrypted Client Hello with a live TLS handshake.
Read the DNS
Inspect HTTPS records, service bindings and published ECH keys.
Prove the handshake
Real TLS connections. Verified certificates. Explicit ECH acceptance.
See the full picture
Per-endpoint results, honest coverage limits and exportable evidence.
THE NEXT LAYER OF HTTPS
Encryption should start
before the conversation.
HTTPS protects what you send. Without ECH, the TLS handshake can still expose the hostname you’re visiting. ECH encrypts that part of the introduction.
Publishing keys is only the first step. ECHScan checks whether a server actually accepts them.
Explore the test methodology →A few things worth knowing
Does a DNS record mean ECH works?
No. A published ECHConfigList is a starting point. Only a verified handshake with ECH acceptance earns a green result.
Does this test my browser?
No. The scan runs from our server using TCP and TLS 1.3. Your browser, network and resolver may behave differently.
Why can endpoints disagree?
Different CDN locations, stale keys or configuration rollouts can produce different answers. We show the individual results and never hide a failure behind one success.
Understand and improve your ECH setup
What is ECH?
Learn what Encrypted Client Hello protects, how it differs from HTTPS and SNI, and why DNS, IP addresses and browser support still matter.
HTTPS DNS records
Understand HTTPS service bindings, ECHConfigList, ALPN, aliases and priorities, and learn why a DNS record alone cannot prove ECH support.
Enable and verify ECH
Plan an ECH deployment: check TLS provider support, publish matching HTTPS DNS records, coordinate key rotation and verify every advertised endpoint.
Troubleshoot a result
Diagnose missing ECH configuration, rejected keys, DNS and certificate errors, mixed IPv4/IPv6 results and incomplete ECH measurements.