{
  "id": 16177995,
  "title": "HTTPS Hides the Page, Not the Hostname: What Your ISP Still Sees",
  "url": "https://urgent.news/2026/10/23/https-hides-the-page-not-the-hostname-what-your-isp-still-sees",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T11:23:39.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/marupxyyz01/https-hides-the-page-not-the-hostname-what-your-isp-still-sees-kn7"
  },
  "original_language": "en",
  "account": "HTTPS encrypts the data transmitted between your device and a website, but it does not hide the hostname of the website being accessed. When you visit a site via HTTPS, the hostname is sent in plain text as part of the ClientHello message, which can be seen by your Internet Service Provider (ISP), the router at the café or any other entity along the path. The ClientHello is sent first and contains the hostname, which your ISP can read but cannot decrypt.\n\nThe Sender may use Encrypted Client Hello (ECH), defined in RFC 9849, to hide the hostname. ECH sends an outer ClientHello with a generic public name and then encrypts the real hostname inside. For ECH to work, three conditions must be met: the browser must support it, the DNS of the site must publish a key, and the three must align for the connection to be encrypted. If these conditions are not met, the hostname is still visible.\n\nA VPN can help hide the hostname from your ISP by routing your connection through a VPN server, encrypting all data transmitted between your device and the internet. However, the VPN operator can still see the traffic, including the hostname. The two tools serve different purposes: ECH hides the name from the path, while a VPN hides the entire list of hostnames from your local network.",
  "summary": "Everyone knows the padlock means \"encrypted\". Fewer people know what it leaves out. When your browser opens https://example.com , it sends a first message to the server called the ClientHello. That message contains the hostname, in plain text, in a field called SNI (Server Name Indication). Your ISP, the café router and anyone else on the path can read it. They cannot read the page, the URL path…",
  "key_points": [
    "HTTPS encrypts data but not hostname",
    "Hostname visible to ISP in ClientHello",
    "Encrypted Client Hello hides hostname"
  ],
  "editors_take": "The visibility of hostnames during the initial handshake means that standard encryption alone fails to prevent service providers from monitoring user browsing habits without the implementation of Encrypted Client Hello.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}