ESNI
ESNI (Encrypted SNI) encrypts the SNI in the TLS ClientHello, preventing on-path observers from seeing which host is visited.
Purpose
It hides the target hostname in the TLS handshake so passive listeners cannot learn which domain the user visits, strengthening privacy.
Mechanism
The client fetches the server's ESNI public key (via the DNS HTTPS RR) and encrypts the SNI extension in the ClientHello with it. The server decrypts it and selects the certificate. It was later superseded by the standardized ECH.
Use cases
- TLS handshake privacy
- SNI encryption
- Defense against passive monitoring
Related tools
HTTP Status Codes
Reference table of common HTTP status codes (1xx-5xx) with names, categories, and descriptions. Free, private, and 100% client-side. TOOL
URL Parser
Parse a URL into its components: protocol, host, path, query, hash, port, username, and password. Free, private, and 100% client-side. TOOL