ENCRYPTED CLIENT HELLO CHECKER
Is your hostname
staying private?
Go beyond DNS. Verify that your domain really negotiates
Encrypted Client Hello with a live TLS handshake.
Read the DNS
Inspect HTTPS records, service bindings and published ECH keys.
Prove the handshake
Real TLS connections. Verified certificates. Explicit ECH acceptance.
See the full picture
Per-endpoint results, honest coverage limits and exportable evidence.
THE NEXT LAYER OF HTTPS
Encryption should start
before the conversation.
HTTPS protects what you send. Without ECH, the TLS handshake can still expose the hostname you’re visiting. ECH encrypts that part of the introduction.
Publishing keys is only the first step. ECHScan checks whether a server actually accepts them.
Explore the test methodology →A few things worth knowing
Does a DNS record mean ECH works?
No. A published ECHConfigList is a starting point. Only a verified handshake with ECH acceptance earns a green result.
Does this test my browser?
No. The scan runs from our server using TCP and TLS 1.3. Your browser, network and resolver may behave differently.
Why can endpoints disagree?
Different CDN locations, stale keys or configuration rollouts can produce different answers. We show the individual results and never hide a failure behind one success.