# What is Encrypted Client Hello (ECH)?

ECH is a TLS extension that encrypts the sensitive part of the ClientHello, including the real server name, with a public key the site publishes in DNS. On the wire, an observer sees only an outer ClientHello carrying a shared public name, typically that of the content-delivery network hosting the site, instead of the actual site. It was designed for privacy: to stop anyone on the path, from a café Wi-Fi to an internet provider, from learning which site you visit. Major browsers support it and some large content-delivery networks offer it, so a share of web traffic already uses it, while most corporate and internal servers do not. ECH usually comes together with encrypted DNS, because otherwise the name would still leak through the DNS query. The certificate and the session content were already encrypted under TLS 1.3; ECH closes one of the last readable fields. For security teams it means fewer names and more reliance on behaviour.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/what-is-encrypted-client-hello

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Does Encrypted Client Hello blind network monitoring?](https://netsenx.com/en/faq/does-encrypted-client-hello-blind-network-monitoring)
- [Do QUIC and HTTP/3 blind firewalls?](https://netsenx.com/en/faq/do-quic-and-http3-blind-firewalls)
- [Can DNS over HTTPS hide traffic from security monitoring?](https://netsenx.com/en/faq/can-dns-over-https-hide-traffic-from-security-monitoring)
- [How do I decrypt TLS traffic for troubleshooting?](https://netsenx.com/en/faq/how-to-decrypt-tls-for-troubleshooting)
- [How does a TLS handshake work?](https://netsenx.com/en/faq/how-does-a-tls-handshake-work)