Encrypted Client Hello

암호화된 클라이언트 헬로

ECH moves the true destination name into an encrypted inner ClientHello.

···
html
<div class="n-demo"><div class="n-head"><strong>CLIENT HELLO VISIBILITY</strong><span>LIVE TRACE</span></div><div class="n-stage"><div class="ech"><div class="ech-row"><span>PLAIN</span><div class="n-box mono">SNI: private.test</div><b>VISIBLE</b></div><div class="ech-row"><span>ECH</span><div id="ech-inner" class="n-box mono">inner: private.test</div><b id="ech-view">SEALED</b></div></div></div><div class="n-foot">tap to step · auto replay</div></div>
css
.n-demo{width:min(94vw,760px);height:min(88vh,324px);padding:clamp(9px,2.2vmin,18px);border:1px solid var(--line);border-radius:13px;background:var(--surface);display:flex;flex-direction:column;gap:clamp(5px,1.3vmin,10px);font:600 clamp(12px,2.4vmin,16px)/1.3 "Pretendard Variable",Pretendard,-apple-system,BlinkMacSystemFont,"Apple SD Gothic Neo",sans-serif;overflow:hidden}.n-head,.n-foot{display:flex;justify-content:space-between;align-items:center;color:var(--muted)}.n-head strong{color:var(--accent)}.n-head span,.n-foot{font-size:12px}.n-stage{flex:1;min-height:0;position:relative;display:flex;align-items:center;justify-content:center;gap:clamp(4px,1vmin,10px)}.mono{font-family:ui-monospace,SFMono-Regular,Consolas,monospace}.n-box{padding:clamp(5px,1.5vmin,11px);border:1px solid var(--line);border-radius:8px;background:var(--bg);text-align:center}.n-on{border-color:var(--accent)!important;color:var(--accent)!important;background:color-mix(in srgb,var(--accent) 12%,var(--surface))!important}.n-muted{color:var(--muted)}@media(max-width:400px){.n-head span{display:none}}.ech{width:96%;display:grid;gap:12px}.ech-row{display:grid;grid-template-columns:47px 1fr 58px;align-items:center;gap:5px}.ech-row span,.ech-row b{font-size:12px}.ech-row b{color:var(--accent-3)}.ech-row .n-box{text-align:left;min-width:0;padding:8px 5px}.ech-row:last-child b{color:var(--accent)}
js
let sealed=true;function advance(){sealed=!sealed;document.getElementById('ech-inner').textContent=sealed?'outer: public.test / inner: [sealed]':'inner: private.test';document.getElementById('ech-inner').classList.toggle('n-on',sealed);document.getElementById('ech-view').textContent=sealed?'SEALED':'BEFORE'}
const clickTarget=document.querySelector('.n-demo');if(clickTarget&&typeof advance==='function'){advance();const timer=setInterval(advance,1050);clickTarget.addEventListener('pointerdown',()=>{clearInterval(timer);advance()})}

TLS ECH encrypts sensitive ClientHello fields. The true server name lives in an inner ClientHello while observers see the outer message.

The demo contrasts a visible plain name with an encrypted inner name. Outer fields and traffic metadata remain visible, and the server and DNS configuration must support ECH.

When to use

Review deployment requirements and privacy limits when reducing hostname exposure during TLS setup.

Open as page ↗