The Browser Setting That Hides Your Browsing From Your ISP (No VPN Needed)
A browser feature called Encrypted Client Hello closes the last big leak that shows your ISP which sites you visit — and it has nothing to do with a VPN. Here's how it works.
Most people assume that once a site loads over HTTPS, their internet provider can't see where they're going. That's mostly true — except for one stubborn leak that quietly told your ISP the name of every site you visited anyway. A browser feature called Encrypted Client Hello (ECH) closes it, and as MakeUseOf points out, it does so without a VPN.
The leak, in plain terms: when your browser starts an HTTPS connection, the very first handshake message historically included the site's name (the "SNI" field) in the clear — before encryption kicked in. Your ISP couldn't read the page, but it could read the name. ECH encrypts that first message too.
How ECH is different from a VPN
This trips people up, so it's worth being precise:
- A VPN hides your traffic by routing everything through a third-party server. Your ISP sees only the VPN. You're trusting the VPN provider instead.
- ECH doesn't reroute anything. It just encrypts the one remaining piece of the handshake that leaked the site name, so your ISP can no longer build a list of the domains you visit — while your traffic still goes directly to the site.
ECH is not anonymity. It hides which sites you visit from your ISP, but it doesn't mask your IP address or make you untraceable. It's one privacy layer, not a cloak.
What you need for it to work
👍 Pros
- ✓No subscription, no extra app — it's built into modern browsers
- ✓No speed hit from routing through a VPN server
- ✓Works alongside encrypted DNS for fuller coverage
👎 Cons
- ✕Both your browser and the website's network must support it
- ✕It hides domain names, not your IP address or identity
- ✕Some networks and older setups don't support it yet
ECH also leans on encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) to close a related leak — the domain lookup itself. Turn both on and your ISP loses its two easiest windows into your browsing. Support is rolling out across major browsers; you may need to enable it in settings or flags, and the site's side has to support it too.
The takeaway
ECH is a quiet but meaningful privacy upgrade: it seals the last routine way your ISP could log which sites you visit, with no VPN, no slowdown, and no subscription. Just don't mistake it for anonymity — pair it with encrypted DNS for the browsing-privacy piece, and use a VPN or Tor only when you actually need to hide your IP or location.
Feature availability depends on your browser version, your network, and the destination site's support; check your browser's privacy settings for the current toggle.
The AI stack, in your inbox
One email a week: the tools worth trying, the automations worth stealing. Join the teams building smarter with UDoIt.
Keep reading
Sony Owes Gamers $7.85M in PlayStation Store Credit — Who Qualifies
Sony agreed to pay $7.85M to settle a PlayStation Store pricing lawsuit, with credit going to ~4.4M accounts. Here's who qualifies, how you get paid, and the key dates.
Apple Watch Series 12 and Ultra 4: What the Leaks Point To
New details on the Apple Watch Series 12 and Ultra 4 are circulating ahead of Apple's fall event. Here's how to read the pre-reveal leaks — and what's actually likely to change.
Cloudflare Freed 100TB of RAM on 1.1.1.1 — Without Adding a Single Server
Cloudflare reclaimed 100TB of memory across its 1.1.1.1 DNS fleet through software optimization alone. A rare, concrete look at how efficiency work pays off at internet scale.