Cleartext Server Name Indication Leaks Visited Domains Over HTTPS: How Encrypted Client Hello Wraps the TLS Handshake in Decoy Metadata

In March 2026, the Internet Engineering Task Force (IETF) published RFC 9849, formally standardizing a cryptographic mechanism designed to close the internet's most persistent privacy leak. The specification, titled TLS Encrypted Client Hello, targets a 23-year-old structural flaw in how web browsers establish secure connections.[1]

When a user types a web address, the resulting HTTPS connection encrypts the data flowing between the browser and the server. However, the initial handshake required to set up that encryption has historically broadcast the exact name of the destination website in plain text.[2]

This broadcast is known as the Server Name Indication (SNI). Because it travels unencrypted, any network observer—from a local coffee shop router to a national telecom provider—can compile a precise, timestamped log of every domain a user visits.[3]

Encrypted Client Hello (ECH) eliminates this exposure by wrapping the sensitive routing data in a layer of decoy metadata. Instead of announcing the true destination to the network, the browser encrypts the request and addresses it to a generic, public-facing server.[1]

The deployment of ECH represents a fundamental shift in internet privacy. With major platforms like Android 17 enabling the protocol by default in September 2026, and 59 percent of browsers already supporting the standard, the era of passive network surveillance via cleartext SNI is rapidly drawing to a close.[4]

The origins of the SNI leak

To understand why browsers broadcast their destinations, one must look back to the architecture of the early web. Before 2003, a secure web server could generally only host a single encrypted website per IP address.[2]

As the internet scaled and IPv4 addresses became scarce, hosting providers needed to serve thousands of distinct websites from a single machine. The server needed a way to know which specific cryptographic certificate to present to the connecting browser before the encrypted tunnel was established.[2]

The solution, standardized in June 2003 and updated in RFC 6066, was the Server Name Indication extension. SNI requires the browser to include the target hostname—such as private.example.org—inside the very first message it sends, known as the TLS Client Hello.[2]

Because the Client Hello is the message that initiates the encryption process, it cannot itself be encrypted by the server's certificate. Consequently, the SNI extension travels across the network in cleartext, visible to anyone monitoring the wire.[5]

Over the past two decades, this cleartext string has become a foundational tool for network management and surveillance. Corporate firewalls use SNI to block access to social media, while authoritarian governments rely on it to enforce national censorship filters.

The limits of TLS 1.3

The introduction of TLS 1.3 in 2018 significantly tightened internet security by encrypting more of the handshake, including the server's digital certificate. Yet, the protocol designers left the SNI extension unencrypted, as they lacked a generic mechanism to hide it without breaking virtual hosting.[1]

Paradoxically, by encrypting the rest of the handshake, TLS 1.3 made the cleartext SNI even more valuable to surveillance systems. With other metadata obscured, network monitors and fingerprinting tools like JA3 became heavily reliant on the 0x0000 extension code to categorize and control traffic.[5]

Security researchers recognized that true web privacy was impossible as long as the destination domain remained visible. Advocacy groups like the Electronic Frontier Foundation argued that the cleartext SNI represented a massive vulnerability for users in restrictive network environments, allowing censors to pinpoint and block specific traffic.

The resulting ECH standard does not merely encrypt the SNI field; it encrypts the entire sensitive portion of the Client Hello message. This prevents observers from using other extensions, such as the Application-Layer Protocol Negotiation (ALPN) list, to deduce the nature of the traffic.[1]

Wrapping the handshake in decoy metadata

The technical elegance of ECH lies in its dual-message structure. When a browser connects to an ECH-enabled server, it actually constructs two distinct Client Hello messages: an inner hello and an outer hello.[1]

The ClientHelloInner contains the true destination domain and the actual cryptographic parameters the browser wishes to use. The browser encrypts this inner message using a 256-bit public key belonging to the server infrastructure.[1]

The browser then embeds this encrypted payload inside the ClientHelloOuter. This outer message acts as a decoy, containing a generic, shared SNI—such as public.example.com—that represents the broader hosting provider or content delivery network.[1]

To an observer on the network, the connection appears to be a routine request to the CDN's public-facing infrastructure. The network hardware routes the packet to the CDN, completely unaware of the hidden ClientHelloInner concealed within the extension data.[5]

Upon receiving the packet, the CDN's edge server uses its private key to decrypt the inner message. It reads the true SNI, selects the correct virtual host, and completes the secure handshake on behalf of the hidden destination.[1]

The role of the anonymity set

For ECH to provide meaningful privacy, the decoy domain must be shared by a large number of distinct websites. This shared infrastructure creates what cryptographers call an anonymity set, hiding the user's specific destination within a crowd of unrelated traffic.[1]

If a server only hosts two websites, knowing that a user connected to the shared outer domain still reveals too much information. However, when a CDN like Cloudflare or Fastly hosts millions of domains behind a single outer SNI, the specific destination becomes mathematically impossible to guess.[5]

This architecture inherently favors massive, centralized hosting providers. A small, independent web server cannot effectively deploy ECH on its own, as it lacks the diverse traffic volume necessary to build a credible anonymity set.[6]

Consequently, the widespread adoption of ECH may further consolidate internet traffic routing. Privacy advocates acknowledge this trade-off, noting that relying on a few massive CDNs for privacy is currently the only practical way to defeat network-level SNI surveillance.[6]

Shifting trust to the DNS layer

The ECH mechanism introduces a new dependency into the web's cryptographic architecture. To encrypt the inner message, the browser must obtain the server's ECH public key before it initiates the TLS handshake.[4]

Browsers fetch this key via the Domain Name System (DNS), specifically through a newly defined HTTPS record type. When the browser looks up the IP address for a website, it simultaneously requests the base64-encoded cryptographic material required to construct the ECH payload.[4]

This reliance on DNS means that ECH is only secure if the DNS query itself is protected. If a user relies on legacy, cleartext DNS over port 53, an eavesdropper can simply read the DNS request to determine the destination, rendering the ECH protection moot.[1]

Therefore, ECH must be deployed in tandem with encrypted DNS protocols, such as DNS over HTTPS (DoH) or DNS over QUIC. Together, these technologies seal the final two metadata leaks in the modern web browsing experience.[4]

The enterprise security backlash

While privacy advocates celebrate the closure of the SNI leak, the enterprise security industry faces a profound loss of network visibility. For decades, corporate IT departments have relied on cleartext SNI to filter malicious domains and enforce acceptable use policies.

A 2026 analysis by Cisco warned that ECH, combined with protocols like QUIC, renders traditional network firewalls effectively blind. "The radar is still on, the screen is still glowing, but you are completely blind to the real danger approaching," the Cisco advisory cautioned regarding the loss of inspection capabilities.

To maintain control, enterprises are increasingly forced to deploy endpoint security agents directly on employee devices. By intercepting traffic at the browser level—before ECH encryption occurs—companies can bypass the network-level obscurity that the new protocol introduces.

Despite these enterprise challenges, consumer technology platforms are moving aggressively to adopt the standard. With Android 17 integrating ECH into its core network libraries and major browsers enabling it by default, the decoy handshake is rapidly becoming the baseline standard for web privacy.[4]