ECH, or Encrypted Client Hello, is a TLS feature that hides much of the early connection setup from outside observers. In a normal TLS handshake, the client may reveal details such as the intended server name and other metadata before encryption is fully established. ECH encrypts that part of the exchange so passive network observers see less about where a user is connecting.
This matters because connection metadata can be used for traffic analysis, tracking, filtering, and censorship. ECH can make it harder for an ISP, Wi-Fi operator, or attacker watching the network to profile browsing habits or identify destinations from the handshake alone. It is not a complete privacy shield: the IP address, timing, and later traffic patterns may still leak information, and both client and server support are required. Defenders use ECH to reduce exposure of sensitive connection details, while attackers may try to rely on older, unencrypted handshakes when ECH is unavailable.