HTTPS Hides the Page, Not the Hostname: What Your ISP Still Sees
Everyone knows the padlock means "encrypted". Fewer people know what it leaves out. When your browser opens https://example.com , it sends a first message to the server called the ClientHello. That message contains the hostname, in plain text, in a field called SNI (Server Name Indication). Your ISP, the café router and anyone else on the path can read it. They cannot read the page, the URL path…
HTTPS encrypts the data transmitted between your device and a website, but it does not hide the hostname of the website being accessed. When you visit a site via HTTPS, the hostname is sent in plain text as part of the ClientHello message, which can be seen by your Internet Service Provider (ISP), the router at the café or any other entity along the path. The ClientHello is sent first and contains the hostname, which your ISP can read but cannot decrypt.
The Sender may use Encrypted Client Hello (ECH), defined in RFC 9849, to hide the hostname. ECH sends an outer ClientHello with a generic public name and then encrypts the real hostname inside. For ECH to work, three conditions must be met: the browser must support it, the DNS of the site must publish a key, and the three must align for the connection to be encrypted. If these conditions are not met, the hostname is still visible.
A VPN can help hide the hostname from your ISP by routing your connection through a VPN server, encrypting all data transmitted between your device and the internet. However, the VPN operator can still see the traffic, including the hostname. The two tools serve different purposes: ECH hides the name from the path, while a VPN hides the entire list of hostnames from your local network.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
