ECH explained: hide the site name from your ISP

Every HTTPS connection starts with a handshake, and for most of the internet's history that handshake leaked the one thing a censor cares about: the name of the site you are visiting. The field is called SNI - Server Name Indication - and it travels in plaintext so busy servers hosting thousands of sites can pick the right certificate. Filtering networks read it and cut exactly the blocked domains, which is why a page can hang forever on https:// while http:// still loads [1].

ECH - Encrypted Client Hello - encrypts that handshake, hiding the site name inside public-looking traffic [1][2]. It is a browser setting plus a compatible host, it costs nothing, and where it works, name-based SNI filtering simply stops. This guide explains what ECH does, how to turn it on, and - honestly - when it does nothing at all.

How ECH hides the site name

The TLS 1.3 handshake sends a ClientHello message before any encryption exists. ECH splits that message in two [1]:

• a ClientHelloOuter, visible to the network, carrying only a harmless public name - usually the host's provider domain - and
• an encrypted ClientHelloInner with the real site name and settings, locked to a public key the site publishes in its DNS records.

The censor sees a normal-looking handshake for a provider like Cloudflare and cannot tell which of the millions of sites behind it you actually meant [1][2]. The design even survives stale keys: if decryption fails, the connection retries with fresh keys instead of dying [1][2].

The three conditions

ECH is a cooperation between your browser, your DNS and the site's host. All three must line up:

1. A browser with ECH support. Firefox and Chrome ship ECH enabled; Edge inherits Chrome's behavior, other Chromium browsers vary. Test your current browser below.
2. Encrypted DNS (DoH) switched on. The ECH public keys arrive inside HTTPS-type DNS records, and the browser must fetch them over DoH for them to survive tampering [1][3]. Our DoH setup guide covers every platform.
3. A site whose host supports ECH. The host publishes the ECH config for the site. Large hosts (Cloudflare among the first) do this for their customers; small self-hosted servers usually do not [1].

Turn it on and verify

Firefox

1. Settings, Privacy & Security, find DNS over HTTPS, set it to Max Protection with a real provider - ECH keys must arrive over encrypted DNS [3].
2. ECH ships enabled by default in recent Firefox; to be sure, open about:config and check that network.dns.echconfig.enabled and network.dns.http3_echconfig.enabled are true [3].
3. Restart the browser.

Chrome and Edge

1. Open chrome://settings/security, enable Use secure DNS, and pick a provider (same reason as above: the keys ride on DNS) [1].
2. ECH is active in current Chrome by default - the flag chrome://flags/#encrypted-client-hello exists for older versions.
3. Restart the browser.

Verify for real

Open tls-ech.dev [4]. It answers plainly: "You are using ECH" or "You are not using ECH". Keep two tabs open - one on the ECH test, one on the blocked site - so you can see exactly when the protection is live. defo.ie hosts additional ECH test endpoints [6].

When ECH helps - and when it does nothing

ECH is a scalpel, not a hammer. It beats one specific kind of block: filtering that reads the TLS handshake. Measure first with the symptom table in our general unblock guide or OONI Probe [5], and check this list before blaming ECH:

• The site does not support ECH. Most of the web is not behind an ECH host; then the handshake is plaintext no matter what your browser does. Check by opening a known-ECH site on the same network: if that works and yours does not, your block is not SNI-based.
• The block is at the IP layer. Packets to the server are dropped regardless of handshakes. You need a tunnel: WARP, Psiphon or the Tor Browser.
• The block is on the site itself. Geo and account walls live after the handshake.
• The censor strikes back. Blocking ECH is the obvious counter-move - a network can filter the DNS records that carry the ECH keys or cut handshakes that offer ECH. If ECH worked yesterday and stalls today, that is what happened; move to a tunnel and its obfuscation, and re-test later.

ECH also pairs beautifully with the lighter tools: encrypted DNS plus ECH is the whole "stealth setup" on a machine where you cannot install anything, and it is the first thing to try before the heavier tunnels [7].