Android 17 Hides Which Sites You Visit From Your ISP

Every time your phone opens an HTTPS connection, it announces where it is going before any encryption starts. The field is called Server Name Indication, it sits in the first packet of the handshake in plain text, and it is how a mobile carrier compiles a list of the sites you visit without touching a single certificate. HTTPS never covered it. Android 17 does.

The change is real and narrower than the headlines suggest. Read the developer documentation next to the consumer announcement and a gap opens up worth understanding before you assume your browsing went dark.

Key Takeaways

• Android 17 enables Encrypted Client Hello across the whole operating system rather than inside one browser, which Google calls a first for a major mobile platform.
• ECH encrypts the Server Name Indication field with a public key the destination publishes in a DNS HTTPS resource record; the IETF published it as RFC 9849 on the standards track in March 2026.
• ECH is on by default for apps targeting Android 17 (API level 37) that use a compatible networking library, with Google pointing developers at OkHttp 5.5.0.
• Your destination IP address, your traffic timing, and any plaintext DNS lookup stay visible, so ECH alone does not make browsing private.
• Russia's Roskomnadzor blocked Cloudflare hosted sites using ECH in November 2024 by matching the shared outer hostname cloudflare-ech.com, which is why Android sends decoy ECH data to servers that lack support.

What Is Encrypted Client Hello?

Encrypted Client Hello is a TLS extension that wraps the opening handshake inside a second, encrypted one, so the hostname you asked for never crosses the network in readable form. The client sends an outer ClientHello carrying a generic public name and, inside it, an encrypted inner ClientHello naming the site it actually wants.

The key must reach you before the connection exists, so ECH leans on DNS. Sites publish an ECH configuration list in the HTTPS resource record defined by RFC 9460. On Android the path runs through DnsResolver.query() with TYPE_HTTPS, handing the resulting EchConfigList to the socket via SSLSockets.setEchConfigList(), per Google's ECH adoption guide.

What Changed by Moving ECH From the Browser to the OS?

Browsers have had ECH for nearly three years, and on a phone the browser was never where most of the leaking happened. Chrome shipped it in version 117 in September 2023, Mozilla enabled it by default in Firefox 119 that October, per Mozilla's ECH explainer. Everything else on the device kept announcing hostnames in the clear: your mail client, your banking app, every bundled SDK.

Android 17 moves the logic into the platform TLS stack, so apps inherit it without writing crypto code. Developers wanting per domain control set <domain-encryption mode="enabled"> in the network security config or query NetworkSecurityPolicy.getDomainEncryptionMode() at runtime. Same instinct as the way Android 17 locked down the accessibility permission most Android malware abuses: the protection nobody has to enable is the one that protects people.

Does ECH Need Encrypted DNS to Be Worth Anything?

Not to function, but yes to matter. Google's consumer announcement says ECH "works in tandem with private DNS to obscure the domain names you visit," while the developer documentation states plainly that ECH requires neither Private DNS nor DNS over TLS nor DNS over HTTPS. Both are accurate, and the space between them is where the privacy lives.

Consider the order of operations. Your phone resolves the hostname, then opens the TLS connection, and ECH covers only the second step. If the first goes out as an ordinary query on port 53, the observer who just lost the SNI field reads the identical hostname one packet earlier. You encrypted the answer and left the question in the open.

Android has shipped Private DNS, its DNS over TLS setting, since Android 9, and most people have never opened it. Networks that tamper with DNS are not hypothetical, as the hotel Wi-Fi networks caught hijacking DNS to reach Microsoft 365 accounts showed this summer.

What ECH Still Does Not Hide

Three things survive the encryption, and each leaks differently.

• The destination IP address. Behind a large shared front end it identifies the provider rather than the site, which is where the privacy comes from. A site on its own address is named by its IP as precisely as the SNI ever named it.
• Timing and volume. When you connect, how long you stay and how many bytes move each way remain in the open, and traffic analysis on those signals is a mature field.
• Anything the server does not support. Cloudflare is why ECH exists at scale: its ECH documentation says it is on by default for Free zones, after a staged rollout from August 2024 that followed an earlier global rollback. Elsewhere, server software that generates ECH keys and publishes them in DNS stays thin on the ground, as the Center for Democracy and Technology noted in its analysis of the SNI metadata gap.

Coverage is lopsided, then: strongest for sites behind the big providers, weakest for the small self hosted server.

Why Do Some Networks Block ECH Outright?

Because a censor who cannot read the hostname can still see that you used ECH, and blocking the category beats filtering it. In November 2024 Russia's Roskomnadzor began dropping connections to Cloudflare hosted sites whenever it saw an outer SNI of cloudflare-ech.com alongside an ECH extension, a filter documented by heise after users lost hundreds of thousands of sites. Free tier customers could not switch ECH off.

Which is why Android does not simply skip ECH where servers lack support. It sends ECH GREASE, a decoy extension with random contents, so a connection using ECH looks like one that does not. Jigsaw tested that against the top 10,000 domains across 740 internet providers in 202 countries with no site loading failures or unexpected blocks, according to BleepingComputer. Uniformity is the point: a protection only the cautious use marks them out, the argument CDT made in Do Not Stick Out.

What This Means for Your Phone

The party losing information is the one on the wire: your carrier, the coffee shop router, the hotel network, the corporate Wi-Fi, whoever keeps the logs at your provider. For that audience the hostname disappears, and every app on the platform networking stack benefits at once.

Nothing changes on the other side. The site still sees your IP address, your requests and whatever identifiers it sets, untouched by anything at the TLS layer. ECH is a network privacy feature, not an anti tracking one; profiling by sites themselves is still fought in the browser, with anti tracking extensions and stricter defaults. And if a mobile OS can hide hostnames by default without breaking the top 10,000 sites in 202 countries, the case for leaving SNI in the clear on desktop gets thinner every quarter.

What to Do Right Now

1. Update to Android 17. None of this exists on API level 36 or lower, whichever browser you run.
2. Turn on Private DNS. Settings, Network and internet, Private DNS, then set a provider hostname. Without it, the name you hid in the handshake still leaves in the lookup.
3. Keep your browser current. Firefox's own documentation is clear that ECH depends on secure DNS being active.
4. Do not retire a VPN over this. ECH hides the name, not the address.
5. If you ship Android apps, target API level 37, move to a networking library with platform ECH support such as OkHttp 5.5.0, and handle the retry path for EchConfigMismatchException when a cached key goes stale. If you run a server, check whether your provider publishes an ECH configuration list at all; on most stacks it does not.

Sources: Google: Android 17 introduces 4 new network security features; Android Developers: Adopting Encrypted Client Hello; IETF RFC 9849, TLS Encrypted Client Hello; IETF RFC 9460, SVCB and HTTPS resource records; Cloudflare: ECH Protocol; Mozilla: Understand Encrypted Client Hello; CDT: Encrypted Client Hello, closing the SNI metadata gap; heise: Russia censors Cloudflare websites; BleepingComputer: Android 17 adds ECH support; The Hacker News: Android 17 adds OS wide ECH. Library support moves quickly; verify current ECH availability in your networking library before shipping.