Encrypted Client Hello
An extension to TLS that encrypts the first message of a secure connection, including the name of the site being visited, so the network path cannot read it. CrawlCheck notes whether a site's DNS HTTPS record publishes ECH keys.
What Encrypted Client Hello does not show
It hides the site name from on-path observers; it does not hide the server's IP address, and it does nothing for the page's content once it arrives.
Where Encrypted Client Hello comes up on this site
- How to check if your website supports HTTP/3The same DNS record can also carry an ech= key for Encrypted Client Hello, which hides which site a visitor is connecting to.
Definitions that name Encrypted Client Hello
Related terms in Security and privacy
Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
X-Frame-Options · frame-ancestors · Referrer-Policy · Permissions-Policy · lookalike domain · homoglyph · incident switch · high-risk field · Indirect prompt injection · Direct prompt injection · Jailbreak · Data exfiltration · Sensitive information disclosure · Secret leakage · Insecure output handling · Excessive agency · Least privilege · Trust boundary · Input validation · Output validation · Allowlist · Denylist · SSRF · RCE · Credential scope · OAuth scope · API key · Bearer token · mTLS · Rate-limit policy · Audit log · PII · Data minimization · Purpose limitation · Retention period · Data residency · Tenant isolation · Threat model · DMARC · DMARC alignment · SPF · DKIM · MTA-STS · TLS-RPT · CAA record · DNSSEC · hard bounce
Questions about Encrypted Client Hello
What is Encrypted Client Hello?
An extension to TLS that encrypts the first message of a secure connection, including the name of the site being visited, so the network path cannot read it. CrawlCheck notes whether a site's DNS HTTPS record publishes ECH keys.
What does Encrypted Client Hello not show or guarantee?
An extension to TLS that encrypts the first message of a secure connection, including the name of the site being visited, so the network path cannot read it. It hides the site name from on-path observers; it does not hide the server's IP address, and it does nothing for the page's content once it arrives.
Which area of the glossary does Encrypted Client Hello belong to?
Security and privacy: Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
← Permissions-Policy · lookalike domain →
See it in the full glossary · 772 terms across 19 areas.
Free browser extension
See this on any site you visit, in one click.
CrawlCheck for Chrome grades every site you visit A–F and shows, from your own browser, what search engines and AI assistants are actually served. Free, no account.