ECH in Plain English: Encrypting More of ClientHello

TLS starts with a ClientHello. That message is how your device and a server agree how to lock the rest of the session. RFC 8446 already encrypts a lot of what used to sit in the open after the first flight. The first flight itself still had leftovers: the server name, and other parameters people with a capture could read. Encrypted Client Hello is the attempt to hide more of that first flight, not only the name field. ESNI tried to hide the name and stalled. ECH is the later design: inner hello encrypted, outer hello still visible so the edge can talk at all.

You do not need the inner-versus-outer diagram memorized to use a website. You need the split. Page body is the padlock. First-flight metadata is ECH's job where it runs. Destination IP is neither. Farms mash all three because all three sound like 'they can see me.' Split them. The SNI in Plain English: The Name TLS Still Sends owns the leftover name as a noun. This page owns the wrap that tries to swallow more of that first packet.

The wrap exists for a privacy reason, not because virtual hosting vanished. Shared hosts still need a name. ECH moves the real name into the inner envelope and puts a public name on the outer one so a CDN can still terminate. Cloudflare's explainer walks that P.O. box metaphor. I will not clone their diagram. I will say: the cafe may see 'talking to a public ECH name' instead of 'talking to your bank.' That is quieter. It is not idle. It is not a VPN.

If you already live in packet captures, you know the extension. If you do not, you do not need to start now. Trust the split: inner parameters versus outer hop versus page body. ECH, when it actually runs, quiets inner parameters on the path. A VPN moves the outer hop. HTTPS locks the page. I will not stand behind 'the cafe sees nothing.' Volume, timing, and the fact you used their AP remain. The first flight is what this page exists to name.

ECH is not a website checkbox you forgot. The browser has to speak it. The CDN or client-facing edge has to advertise a public key, usually via HTTPS records in DNS. The origin stack behind that edge has to be in a config that actually offers ECH. Miss any chair and the first flight stays the old first flight. That is why 'ECH shipped in 2023' and 'my bank still shows a name on cafe Wi-Fi' can both be true before lunch.

Browsers disagree. A nightly build is not your aunt's Chrome. A corporate-managed browser may disable the experiment. A phone WebView may not match the desktop story. I will not publish a compatibility matrix that goes stale on Tuesday. Assume the client in your hand might not be the client in a press release.

CDNs disagree. One edge network has been loud about ECH. Other hosts still terminate TLS the old way. A site on a cheap shared box with a single certificate may not have an ECHConfig to publish. A site behind a middlebox that wants to read names will not help you hide them. You do not pick the stack when you tap a link. The stack picks you.

Origins disagree. Turning ECH on at a CDN dashboard does not rewrite every origin on earth. A marketing domain on Cloudflare and an API on a regional load balancer are two deployments. Farms write as if the internet is one vendor. It is not. Three parties. Three failure modes. That is the product state, not a temporary bug you wait out while skipping a tunnel.

Some paths have ECH. Some do not. Some have it in one browser and not another. Some have it until a hotel middlebox, a school filter, or a 'security appliance' that still wants names. Do not write 'SNI is dead' because a CDN blog said the last puzzle piece shipped. Do not write 'ECH never works' as if the IETF work was fiction. Uneven means uneven. Plan as if the first flight might still be readable on the clear path you actually use this afternoon.

I will not perform handshake theater. No screenshots of extension lists. No draft numbers you have to memorize to use Klox. If you want to see a ClientHello on your own LAN, you already know Wireshark. If you do not, you do not need to. The consumer fact is: assume the wrap might be missing. Assume a tunnel still earns its keep when the wrap is present, because IPs remain.

Retry is part of the design. If the edge cannot decrypt the inner hello, it may complete on the outer hello and hand back a key so the client can try again. That retry can look like 'ECH' in a lab and still spend a moment looking like a clear name to a capture. GREASE exists so ECH-shaped hellos are not a rare fingerprint. Those are protocol details. They are not a promise that your cafe path is quiet.

NordVPN's HTTPS-versus-VPN post is a specimen of the mash: padlock versus tunnel as a winner. ECH farms mash the wrap versus invisibility the same way. Use the specimen. Do not import a winner. There is no winner. There is a first flight, an IP, a padlock, and a hop you can turn on.

Hide the inner ClientHello and you still have numbers. You opened a connection to some address for some number of minutes. An observer who already knows who lives at that address does not need the inner name. A small site on a dedicated IP is a doorbell. A huge CDN anycast IP is a neighborhood. Do not pretend every IP is a neighborhood. Do not pretend every IP is a doorbell. Reality is mixed. ECH does not delete the mix.

Volume remains. Timing remains. A four-hour fat blob is still a four-hour fat blob. The wrap changes which letters sit in the first flight. It does not make you look idle. A VPN changes who the cafe thinks you talked to. It also does not make you look idle. Both sentences can be true. Farms omit the second one because idle sells.

SNI quieter is not DNS quieter. If the resolver question still left in the clear before TLS started, the shopping list already shipped. ECH does not time-travel. Tunnel DNS is a different leftover. Encrypted DNS to a public resolver is another. Stacking them as vitamins is how tickets start. One owner for names while a tunnel is up. Klox is that owner on our apps. We are not selling a picker.

I will not invent city counts so the map sounds fancier. You pick a server in the app. Nearby is usually enough when the job is 'hide this hop from the shop,' not 'pretend I live in a catalog.' Catalogs are a different article. This one is numbers that survive a wrapped first flight.

ECH is a browser-and-CDN story. The tunnel is a device-to-node story. Keep them in separate drawers. Mixing them is how you get a ticket that says 'why is the first flight still a thing if I paid for a VPN.' Because ECH lives in the TLS stack of the client talking to the site. A VPN encrypts a hop to a node you chose. After that node, you still speak HTTPS like everyone else. The inner handshake still exists. The cafe does not sit on it when the tunnel is up. The hop operator is not the website.

I will not pretend our Connect button ships ECH for you. There is no row. There is no 'encrypt ClientHello' switch. Features lists DNS through the tunnel, IPv6 leak protection, WebRTC leak blocking. Quote those for Connect. Do not quote them for a Firefox flag. Do not quote them for a CDN dashboard you do not run.

WireGuard first. OpenVPN when the AP hates UDP. Same ECH story on both protocols: we do not implement the wrap, and we do not need to for the cafe hop to move. Protocol hopping is not extra ECH. Five devices: phone plus laptop is two seats if both tunnels are up. A tunneled phone does not wrap the laptop's clear first flight. Count.

Smart Connect, if the app shows the row, is connect on untrusted Wi-Fi. It starts the hop that moves the interesting packet off the cafe path. It does not enable ECH. If the row is missing, you have a Connect button. Use the button. I will not invent an always-on handshake wrap so this article matches another vendor's screenshot.

With Klox up, the interesting hop for the cafe and the ISP becomes the VPN server. They still know you used the AP. They still see volume. They see a destination you chose when you picked a node. They do not get the inner map of sites unless something leaked around the tunnel: DNS, IPv6, WebRTC, an excepted app, a second NIC. Features lists tunnel DNS, IPv6 leak protection, WebRTC leak blocking. Confirm after connect if you like labs. Then stop collecting testers.

ECH on the inner path still depends on the three parties. The cafe does not care. The cafe sees a blob. That is the hop job. It is true whether the site you later open has ECH, lacks ECH, or has it only on Tuesdays. 'ECH shipped, so I uninstalled the VPN' is a bad slogan for the same reason 'HTTPS shipped, so I uninstalled the VPN' was a bad slogan. Different leftover. Same mistake.

The website still sees you logged in. A tunnel is not a new identity. It is a new first hop. Inner TLS still ends at the site. RFC 8446 still applies. People ask whether the VPN can read the page. On a normal HTTPS site, the inner lock still faces the site. The hop operator sees a tunnel. The resolver, if it is ours, sees names. That is a shopping list at a hop, not an inbox.

I will not crown ECH versus VPN. You can have both. You can have neither. You can have ECH in one tab and a clear first flight in an app that is not a browser. Per process. Per device. A tunneled Pixel does not wrap a laptop that never connected. Download from /download so you are not configuring a cousin app's 'Secure Handshake' screen from memory.

When ECH cannot run, the client falls back to the old first flight. That is how the web keeps loading. It is also how a capture on cafe Wi-Fi still gets a name. Filters that break ECH on purpose count on that fallback. A school that inspects TLS will not thank you for a GREASE hello. A cafe captive portal does not speak ECH. Complete the splash on a boring site. Then Connect. The habit post owns the timing. Here: do not treat a failed wrap as a Klox outage.

Certificate warnings are still your job. A tunnel encrypts a mistake as happily as a real bank. The padlock on a host you did not intend is not the padlock you wanted. ECH on a lookalike domain is still a wrap to a liar. Phishing is a lie you believed. Encryption of a lie is still a lie. I will not turn this into a PKI course. Trust the browser's name match. Do not install a cafe's extra root because a PDF said Wi-Fi required it.

Hiding a first flight, whether by ECH or by a tunnel, cannot scan the attachment. It cannot make the AP honest. An evil twin still gets your traffic. Encrypted, if the tunnel is up. The twin can still captive-portal you, still annoy you, still see that you spoke to a VPN. Encryption is not authentication of the coffee shop. Ask the staff the SSID.

It cannot replace unique passwords. It cannot replace updates. It cannot replace 2FA. The What a VPN Cannot Do catalog owns that list. I will not paste it. I will say: a quieter ClientHello on a phone full of reused passwords is a nicer hop for the same account takeover. It cannot unlock a streaming catalog I did not promise. ECH trivia plus a VPN is not a Netflix product.

If you want proof the hop moved, use the leak-test after connect article. IP, DNS, WebRTC, IPv6 as a procedure. This page will not become that procedure. ECH is not a row on most consumer leak sites. Those sites show an IP and a resolver. They do not print your last ClientHello. Do not demand they do. If the IP is the VPN and DNS is the tunnel, the cafe's interesting hop moved. That is the check that pays rent. It pays even when ECH is perfect on the inner site, because the cafe was never supposed to sit on that inner hello.

Do it once on a network you control. Then stop. Daily labs are how people forget to live. If a test fails, fix the leftover: IPv6, WebRTC, a browser DoH override, an excepted app. Then test once more. Then drink the coffee.

Yearly from $2.83 a month is not a reason to skip the padlock. It is a reason you can afford the hop without a farm's lifetime coupon. Seven days on first purchase if the product is not the hop you wanted. Refunds live on /refund. Store purchases follow the store. This page will not turn into a billing sermon. It will also not turn into an ECH roadmap. Absence of a toggle is the product.

If you only needed the English, stop here. If you needed the leftover name as a noun, the SNI essay is next door. If you needed two locks as a pair, that URL exists. If you needed cafe timing, that habit post exists. If you needed the shopping list, DNS on a VPN owns it. If you needed a cape, you wanted a farm. If you needed a hop that still moves the first flight off the LAN, you wanted Klox. Practice once on a guest SSID. Then use it.