ENCRYPTED CLIENT HELLO EXPLAINED
What is ECH?
Encrypted Client Hello protects the hostname carried in the opening TLS handshake. That hostname is normally sent through Server Name Indication (SNI), which helps a shared server select the right website. Ordinary HTTPS encrypts page content, but an unencrypted ClientHello can still disclose which hostname you requested.
How the connection changes
A client obtains the server’s ECH configuration, commonly through an HTTPS DNS record. It encrypts an inner ClientHello for the server, while an outer ClientHello remains visible. The server must possess the matching private key and accept ECH during the handshake. Publishing configuration alone does not establish that this works.
What ECH does and does not hide
The destination IP address, the outer public name and traffic patterns remain observable. Plaintext DNS can also disclose the hostname. Encrypted DNS and ECH protect different parts of a connection; neither makes browsing anonymous.
Domain support and browser support
ECHScan tests your domain from its own server. A successful result does not test the browser you are using, its resolver or its network. For a browser connection, the client must also obtain and use the configuration successfully.
Check your domain’s ECH handshake →
Protocol reference: RFC 9849: TLS Encrypted Client Hello.