Android 17 Integrates Encrypted Client Hello for Enhanced Privacy

Android 17 now includes platform support for Encrypted Client Hello (ECH), a privacy feature designed to encrypt the domain name during connection initiation. This prevents network intermediaries from identifying the destination.

Google has stated that this release marks the initial widespread implementation of ECH across a major mobile operating system. This development involved collaboration with its Jigsaw team and external developers.

Traditionally, web page content is encrypted via HTTPS, but the connection handshake reveals the site name through the Server Name Indication (SNI) field. This allows any network node between a device and a server to read and log visited sites.

Encrypted Client Hello addresses this by encrypting the SNI field. The client encrypts the site name using a key published by the destination server, which is the only entity capable of decrypting it. Network observers will then see an unintelligible label instead of the domain.

This functionality operates in conjunction with private DNS, which already conceals the process of converting a domain name into an IP address.

ECH safeguards traffic exclusively to destinations that have implemented it. Google is encouraging developers to update to OkHttp 5.5.0 and activate the feature. Until broader adoption occurs, requests to sites without ECH will still disclose their domain to the network.

Although the domain name is hidden, the network can still observe the destination server's IP address and data volume. This allows for a coarse inference of activity. Beyond ECH, Android 17 also activates Certificate Transparency by default and mandates that applications request permission before scanning local networks.