ECH (Encrypted Client Hello)
A TLS 1.3 extension that encrypts the ClientHello (including SNI) so on-path observers cannot see which hostname is being requested.
ECH (Encrypted Client Hello) is the modern replacement for the abandoned ESNI draft. It encrypts the entire ClientHello, including the SNI field that historically leaked the destination hostname in cleartext even on TLS-secured connections. The client fetches the server's ECH public key via DNS (an HTTPS resource record), wraps the real ClientHello inside an outer ClientHello addressed to a generic front-end, and the server unwraps it. ECH is widely deployed by Cloudflare and supported by recent versions of Firefox and Chrome, closing one of the last major plaintext metadata leaks in HTTPS.