ECH / Encrypted SNI Check

Where this comes from

TLS encrypts the content of a connection and has always announced the destination hostname in plaintext at the start of the handshake — which made the encryption largely beside the point for the question of what you were reading. Encrypted Client Hello closes that, and whether it happened is not something a browser will tell a page. The edge's trace endpoint reports what it received, so the answer here is an observation about the handshake that fetched this page rather than a guess from your browser version. That distinction matters because support and use are very different: ECH needs the browser, the setting, working DNS-over-HTTPS and a server publishing the key, all at once.

What the results mean

Encrypted

The server name was hidden from anyone watching the network. They saw the network you contacted, not the site.

Sent in the clear

The default, and how TLS has always worked. The hostname is announced before encryption begins.

Requires secure DNS

The requirement most often missed. Both Firefox and Chrome need DNS-over-HTTPS active for ECH to engage.

Does not hide the address

For a site on its own IP, the address identifies it regardless.

Common problems and fixes

My browser supports ECH but it shows plaintext

Support is not enough. It needs DNS-over-HTTPS working, since the key is published in DNS — that is the requirement people most often miss.

It works here but not on another site

Most of the internet has not deployed it. The server has to publish an ECH key, and relatively few do.

Does this hide which sites I visit?

From an observer reading the handshake, yes. The IP address you connect to is still visible, so a site with its own address is identified by that instead.

Frequently asked questions

More in Connection

• TLS Version & Cipher ViewerSee the TLS version and cipher suite this connection actually negotiated.
• HTTP/2 vs HTTP/3 CheckCheck whether your connection is using HTTP/3.