# What Is ECH (Encrypted Client Hello)? Definition and Examples

> ECH (Encrypted Client Hello) is a TLS 1.3 extension that encrypts the sensitive parts of the ClientHello, including SNI, with a public key published in DNS.

Source: https://ssl.sh/glossary/ech/
Last updated: 2026-11-10

Encrypted Client Hello is standardized in [RFC 9849](https://www.rfc-editor.org/rfc/rfc9849), published in March 2026. The client builds two ClientHellos: an inner one containing the real [SNI](https://ssl.sh/glossary/sni/), the ALPN list and other private extensions, encrypted with HPKE under the server's ECH public key, and an outer one that carries only the public name of the client-facing server. The client-facing server decrypts the inner ClientHello and continues the handshake with it.

## Why it matters
SNI is plaintext even in TLS 1.3, so anyone on the path can see which hostname a client requests. ECH closes that gap when many sites sit behind one provider, because observers see only the shared public name. The ECH configuration is usually published in the `ech` parameter of a DNS HTTPS record, and browsers generally fetch it over encrypted DNS, since a plaintext DNS lookup would reveal the name anyway. ECH also defines a retry path: if the server cannot decrypt the inner ClientHello, it completes the handshake on the outer one and returns fresh configurations, so stale DNS data does not permanently break connections. For enterprise networks, ECH means policies that classify traffic by SNI stop seeing the real hostname.

## Example
```bash
dig +short HTTPS example.com
# 1 . alpn="h3,h2" ech=<base64-encoded ECHConfigList>
```

If such a record exists and the browser supports ECH, a packet capture shows only the provider's public name in the outer ClientHello.

## Common misconceptions
- **ECH makes the visited site invisible.** The destination IP, unencrypted DNS queries and traffic patterns can still reveal a lot; ECH mainly hides the hostname when many sites share one front end.
- **ECH is just ESNI renamed.** [ESNI](https://ssl.sh/glossary/esni/) encrypted only the SNI extension and never became an RFC; ECH encrypts the whole inner ClientHello.
- **Any server can enable ECH with one setting.** It needs [TLS 1.3](https://ssl.sh/glossary/tls-1-3/), an ECH key pair, DNS publication and key rotation, so it is mostly deployed by CDNs and large operators.

## Related terms

- [SNI](https://ssl.sh/zh/glossary/sni/): SNI 是 TLS 的一个扩展，客户端在 ClientHello 中写明要访问的域名，使同一个 IP 能为多个 HTTPS 站点分别返回各自的证书。
- [ESNI](https://ssl.sh/zh/glossary/esni/): ESNI 是一个已被放弃的 TLS 1.3 草案，用发布在 DNS 中的公钥只加密 SNI 字段，现已被 ECH 取代。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [TLS 握手](https://ssl.sh/zh/glossary/tls-handshake/): TLS 握手是 TLS 连接开始时的一组消息交换，客户端与服务器在其中协商协议版本和密码套件、验证服务器身份并派生会话密钥。
- [ALPN](https://ssl.sh/zh/glossary/alpn/): ALPN 是一个 TLS 扩展，让客户端和服务器在握手过程中直接商定上层协议，例如 h2 或 http/1.1，不需要额外往返。
- [QUIC](https://ssl.sh/zh/glossary/quic/): QUIC 是基于 UDP、始终加密的传输协议，把 TLS 1.3 握手内置在传输层中，HTTP/3 就运行在它之上。