The newly finalized Encrypted Client Hello (ECH) standard, established in RFC 9849, enhances internet privacy by masking the specific website hostnames previously visible to internet service providers during connections.

Key Points

• The ECH standard, finalized in March 2026, encrypts the Server Name Indication (SNI) field to prevent ISPs from tracking domain-level browsing activity.
• ECH functions by sending a decoy handshake to the server while hiding the actual destination hostname within an encrypted, secondary message.
• Major browsers including Chrome and Firefox have supported ECH since September 2023, with Android adding native support in August 2026.
• Users can verify ECH functionality by checking the "sni=" status on the Cloudflare diagnostic page, which confirms if the connection is encrypted.
• ECH does not replace the need for encrypted DNS or browser fingerprinting protections, as it only secures the initial handshake hostname.

Why it Matters

This technology closes a significant privacy loophole that allowed ISPs to monitor user browsing habits for advertising and profiling purposes. By automating this protection at the browser and operating system level, ECH provides a more secure baseline for all internet users without requiring manual configuration.