Encrypted SNI (ESNI)

Encrypted SNI (ESNI) addresses a subtle leak in HTTPS. During the TLS handshake, the client normally sends the destination hostname in the clear in the Server Name Indication field so a server hosting many sites knows which certificate to present. That means a network observer can see which site you are visiting even though the page contents are encrypted. ESNI, and its more complete successor Encrypted Client Hello (ECH), encrypt that field so the hostname is no longer exposed on the wire.

This matters because it closes one of the last plaintext signals in an otherwise-encrypted session, complementing encrypted DNS: DoH hides the lookup, and ESNI/ECH hides the hostname in the handshake, so together they remove the easy ways to see where you are going. Support depends on the browser, the server and the CDN in front of it, and adoption is still uneven, with ECH now the direction of travel. For everyday privacy it is one more layer rather than a standalone tool — most useful combined with a VPN and encrypted DNS rather than relied on alone.

Support for ESNI and ECH depends on your browser, the server and the CDN in front of it, and adoption is still uneven, with ECH the direction of travel. Treat it as one layer among several: combine it with encrypted DNS to hide the lookup and a VPN to hide your IP, so the hostname, the query and the origin are all covered. On its own, hiding the SNI field closes a single leak rather than delivering end-to-end anonymity.