SNI in Plain English: The Name TLS Still Sends

A lot of websites share a box. One IP, many hostnames, many certificates. The client has to say which name it wanted before the server can pick the right cert. That sentence is Server Name Indication. Historically the name rode in the ClientHello in the clear. The rest of TLS could still wrap the page. The name had already left the building.

You do not need a lab to use the idea. You need to stop treating 'encrypted website' as 'nobody learned which website.' The cafe radio, the hotel concentrator, your ISP, a bored roommate with Wireshark: they can often read the letters. They cannot read the inbox. Those are different sentences. Farms mash them because both sound like 'they can see me.' Split them.

The name exists for an operational reason, not a surveillance reason. Shared hosting and CDNs need it. Turning it off on the open web would break a pile of certificates. Encrypted Client Hello is the industry's attempt to hide more of that first flight. It is not a consumer toggle in Klox. It is a browser, CDN, and origin story. I will not pretend our Connect button ships ECH for you.

If you already live in packet captures, you know the field. If you do not, you do not need to start now. Trust the split: page body versus hop metadata. SNI is metadata. A VPN moves metadata by making the cafe's interesting packet a blob to a node you chose. That is the whole product claim I will stand behind. I will not stand behind 'the cafe sees nothing.' Volume, timing, and the fact you used their AP remain. The name is what this page exists to name.

RFC 8446 is how a lot of the public web encrypts the session. Mail web UIs. Banks. Work chat. Stores. The waiter with a laptop is not reading your password from those TLS records if the certificate matches the host you meant. That fight is mostly over. Farm copy still writes as if 2012 HTTP were the default. It is not. If your scare is the page body on cafe Wi-Fi, check the padlock first.

The leftover after you grant TLS is quieter. Destination IP. Often the server name in SNI. DNS if names never entered another wrap. That is a map of who you talked to. It is not the email. People who say 'I have HTTPS so I do not need a VPN' are often talking about the email and forgetting the map. People who say 'HTTPS is fake' are often selling a tunnel with a scare that 2012 already retired. Both pitches skip the name.

I will not crown a winner. The two-locks article already refused that game. Here the job is narrower: admit the page is locked, then look at the name. If you cannot hold both facts, you will either skip a hop you wanted or buy a cape you do not need.

Certificate warnings are still your job. A tunnel encrypts a mistake as happily as a real bank. The padlock on a host you did not intend is not the padlock you wanted. SNI on a lookalike domain is still a name. It is the wrong name. Phishing is a lie you believed. Encryption of a lie is still a lie. I will not turn this into a PKI course. Trust the browser's name match. Do not install a cafe's extra root because a PDF said Wi-Fi required it.

Hide the letters and you still have numbers. You opened a connection to some address for some number of minutes. An observer who already knows who lives at that address does not need SNI. A small site on a dedicated IP is a name in all but spelling. A huge CDN anycast IP is quieter: many names share the number, so the number is a neighborhood, not a doorbell. Do not pretend every IP is a neighborhood. Do not pretend every IP is a doorbell. Reality is mixed. Plan for mixed.

Encrypted Client Hello, when it actually runs, shrinks the name. It does not delete the TCP or QUIC session to an IP. Volume remains. Timing remains. A four-hour fat blob is still a four-hour fat blob through a VPN too. The tunnel changes who the cafe thinks you talked to. It does not make you look idle.

This is why 'ECH shipped, so I uninstalled the VPN' is a bad slogan. ECH is uneven. IPs remain even when ECH is perfect. A VPN still collapses the outer hop to 'talk to the VPN' from the cafe's chair. That sentence is true whether SNI is loud, quiet, or gone on that particular site.

I will not invent city counts so the map sounds fancier. You pick a server in the app. Nearby is usually enough when the job is 'hide this hop from the shop,' not 'pretend I live in a catalog.' Catalogs are a different article. This one is numbers that survive a hidden name.

Encrypted Client Hello is the industry name for hiding more of the TLS ClientHello, including the server name, from the path. Browsers, CDNs, and origin configs have to agree. Some paths have it. Some do not. Some have it on Tuesday and not on a corporate middlebox that still wants to see names. Do not write 'SNI is dead in 2026' because a blog said ECH exists. Do not write 'SNI always dooms you' as if ECH never ships.

I will not perform handshake theater. No screenshots of extensions lists. No draft numbers you have to memorize to use Klox. If you want to see SNI on your own LAN, you already know Wireshark. If you do not, you do not need to. The consumer fact is: assume the name might still be visible on a clear path. Assume a tunnel still earns its keep when the name is hidden, because IPs remain.

Klox does not claim to implement ECH for you. ECH is a browser-and-CDN story. The tunnel is a device-to-node story. Keep them in separate drawers. Mixing them is how you get a ticket that says 'why is SNI still a thing if I paid for a VPN.' Because SNI lives inside the inner TLS after you decrypt at the node, or on the clear path if you never tunneled. The cafe does not get the inner SNI when the tunnel is up. The path from the VPN node to the site still does TLS like everyone else. That inner name is not the cafe's problem anymore. It is a hop-operator fact, same as any other HTTPS client on the internet.

RFC 8446 is TLS 1.3. ECH rides later work. You do not need the draft to tap Connect. You need to stop treating the address-bar lock as a complete privacy product, and stop treating a press release about ECH as a uninstall-the-app event.

HTTPS can hide page bodies and still leave names on the floor if DNS never entered a tunnel. You type a host. The stub resolver asks someone what IP that is. Off a VPN, that someone is often the ISP or the cafe router. That question is a shopping list. SNI is a later name, during TLS start, to the IP you already learned. Two names, two moments. People mash them because both are letters.

On a VPN, if the client is doing the job Klox documents, DNS rides the tunnel. The ISP sees a blob to the VPN, not the list. That leftover is why What DNS Does on a VPN (Plain English) exists. I will not rewrite the resolver plot. I will say: hiding SNI does not hide a clear DNS query that already happened. Encrypting DNS with browser DoH to a third party does not hide the IP you later connect to. Different envelopes. The DoH essay is a sibling if you wanted that fight. This page stays on the TLS name.

Do not stack a public resolver, browser DoH, and tunnel DNS as vitamins. One owner for names while the tunnel is up. Klox is that owner on our apps. We are not selling a custom-DNS picker here. If a farm tells you to type 1.1.1.1 into the adapter 'for speed,' that farm is teaching a different leftover. That leftover can undo tunnel DNS on purpose.

IPv6 can be another leftover: a v6 path that never entered a v4-only tunnel. WebRTC can ask STUN for a public IP while the UI says connected. Features lists protections. This is still not the leak-test article. It is why 'HTTPS finished the job' is the wrong slogan even after you grant TLS, and why 'ECH finished the job' is the wrong slogan even after you grant a quieter ClientHello.

With Klox up, the interesting hop for the cafe and the ISP becomes the VPN server. They still know you used the AP. They still see volume. They see a destination you chose when you picked a node. They do not get the inner map of sites unless something leaked around the tunnel: DNS, IPv6, WebRTC, an excepted app, a second NIC. Features lists tunnel DNS, IPv6 leak protection, WebRTC leak blocking. Confirm after connect if you like labs. Then stop collecting testers.

The inner SNI, the one in the TLS session from the node to the site, still exists. The cafe does not sit there. The VPN path still looks like a normal HTTPS client to the website, plus an exit IP that is not your house. The website still sees you logged in. A tunnel is not a new identity. It is a new first hop.

WireGuard first. OpenVPN when the AP hates UDP. Same SNI story on both protocols. Protocol hopping is not extra ECH. Five devices: phone plus laptop is two seats if both tunnels are up. The name-hide is per device. A tunneled phone does not hide SNI on a laptop that never connected. Count.

Smart Connect, if the app shows the row, is connect on untrusted Wi-Fi. It starts the hop that moves SNI off the cafe path. It does not encrypt ClientHello by itself. If the row is missing, you have a Connect button. Use the button. I will not invent an always-on lock so this article matches another vendor's screenshot.

Hiding SNI from the cafe, whether by ECH or by a tunnel, cannot stop you from logging into a fake bank. It cannot scan the attachment. It cannot make the AP honest. An evil twin still gets your traffic. Encrypted, if the tunnel is up. The twin can still captive-portal you, still annoy you, still see that you spoke to a VPN. Encryption is not authentication of the coffee shop. Ask the staff the SSID.

It cannot hide that you are on that SSID. Shop logs, AP vendor, sometimes a camera over the till: those are not SNI problems. If your threat is a person in the room, sit differently. If your threat is the LAN graph, tunnel. If your threat is the site, that is the site.

It cannot replace unique passwords. It cannot replace updates. It cannot replace 2FA. The What a VPN Cannot Do catalog owns that list. I will not paste it. I will say: a quieter ClientHello on a phone full of reused passwords is a nicer hop for the same account takeover.

It cannot unlock a streaming catalog I did not promise. SNI trivia plus a VPN is not a Netflix product. If a farm said otherwise, they were selling a cookie. Klox is a tunnel, five devices, two protocols. Use it as that. It cannot be SOC 2 because a buyer likes logos. I will not invent an audit PDF in an SNI lesson. Consumer Klox is a hop. Cookies on this site live at /cookie and are not a handshake field.

If you want proof the hop moved, use the Leak Test After You Connect a VPN article. IP, DNS, WebRTC, IPv6 as a procedure. This page will not become that procedure. SNI is not a row on most consumer leak sites. Those sites show an IP and a resolver. They do not print your last ClientHello. Do not demand they do. If the IP is the VPN and DNS is the tunnel, the cafe's interesting hop moved. That is the check that pays rent.

Do it once on a network you control. Then stop. Daily labs are how people forget to live. If a test fails, fix the leftover: IPv6, WebRTC, a browser DoH override, an excepted app. Then test once more. Then drink the coffee.

Yearly from $2.83 a month is not a reason to skip the padlock. It is a reason you can afford the hop without a farm's lifetime coupon. Seven days on first purchase if the product is not the hop you wanted. Refunds live on /refund. Store purchases follow the store. This page will not turn into a billing sermon.

If you only needed the English, stop here. If you needed two locks as a pair, the HTTPS essay is next door. If you needed cafe timing, that habit post exists. If you needed the shopping list, DNS on a VPN owns it. If you needed a cape, you wanted a farm. NordVPN's HTTPS-versus-VPN post is a specimen of the mash. Use it as a specimen. Do not import their winner. There is no winner. There is a name, an IP, a padlock, and a tunnel you can turn on.