{
  "id": 7485080,
  "title": "The hostname you visit over HTTPS is sent in plain text",
  "url": "https://urgent.news/2026/09/15/the-hostname-you-visit-over-https-is-sent-in-plain-text",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-15T05:50:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/remdore/the-hostname-you-visit-over-https-is-sent-in-plain-text-563g"
  },
  "original_language": "en",
  "account": "The domain name of the website you are trying to access is transmitted in plain text when you connect to it using HTTPS. Despite the connection being encrypted end-to-end, the hostname is sent in clear, at the very beginning of each HTTPS connection, which was surprising to the author. This behavior is intentional and not a bug, as the server needs to know which certificate to send and requires the hostname before it can encrypt the connection. The hostname is sent in the Server Name Indication (SNI) extension, which is sent in the TLS ClientHello message. This message is sent before any encryption happens, so no key or decryption is needed for the passive observer. The article also discusses how TLS 1.3, which encrypts more of the handshake, still leaves the ClientHello and the SNI exposed in plain text. The article introduces Encrypted Client Hello (ECH) as a potential solution to this issue. ECH uses DNS records containing public keys to encrypt the real hostname, making it unreadable to passive observers.",
  "summary": "I had assumed, without ever checking, that the padlock meant nobody on the network could tell which site I was visiting. The connection is encrypted end to end, so surely the destination is part of what gets hidden. It is not. The name of the site you are asking for travels across the network in plain readable text, at the very start of every HTTPS connection, and I wanted to see it with my own…",
  "key_points": [
    "Hostname transmitted in plain text during HTTPS connection.",
    "Server Name Indication (SNI) extension reveals hostname.",
    "Encrypted Client Hello (ECH) proposed to encrypt hostname."
  ],
  "editors_take": "This revelation that hostnames are sent in plain text during HTTPS connections underscores a significant limitation in current encryption protocols, potentially exposing users to surveillance by passive observers.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}