Vercel Adds Encrypted Client Hello (ECH) Support to Its CDN.

Vercel has added Encrypted Client Hello (ECH) support to its content delivery network, closing a long-standing privacy gap in HTTPS connections. The feature encrypts the hostname sent during the opening stages of a secure connection, making it harder for network operators and other intermediaries to see which Vercel-hosted website someone is visiting.

The company announced the change in its changelog on August 14. It applies to domains managed by Vercel DNS and is handled at the platform level, with no application code changes required.

That makes this a largely invisible infrastructure update for builders, but a meaningful one for their users.

HTTPS already encrypts the contents of a connection, including pages, form submissions, API calls and authentication data. Until now, however, the TLS handshake commonly exposed the Server Name Indication, or SNI. This field tells a server which hostname the client wants to reach, allowing shared infrastructure to select the correct website and certificate.

Because SNI was visible before the encrypted session was established, a network observer could often determine that someone was connecting to a particular domain, even without seeing what they did there. This could include an internet service provider, the operator of a public Wi-Fi network or another intermediary on the connection path.

ECH addresses that limitation by encrypting the sensitive ClientHello information, including SNI. According to Vercel, observers will instead see a connection to its shared ECH hostname, vercel-ech.com, rather than the destination site’s hostname.

The result is stronger privacy at the CDN boundary without requiring businesses to redesign their applications. Sites still use the existing TLS and CDN infrastructure, while compatible clients gain additional protection during connection setup.

ECH should not be treated as an anonymity system. Network observers can still see information such as IP addresses, connection timing and traffic volume, and hostname information may be exposed elsewhere if other privacy-preserving technologies are not in use. Its narrower purpose is to prevent the TLS handshake itself from openly identifying the requested hostname.

Vercel says ECH is managed by the platform and enabled automatically where it is supported. The key eligibility requirement disclosed in the announcement is that the domain must be managed through Vercel DNS.

In practical terms, builders should expect the feature to work when both sides of the connection support it:

• Vercel manages the domain’s DNS, allowing the platform to provide the information clients need to use ECH.
• The visitor uses a compatible browser, with Vercel naming recent versions of Chrome, Edge and Firefox.
• The network permits the connection, since some environments may interfere with newer encrypted protocols or require fallback behavior.

Vercel does not describe a dashboard switch, application setting or deployment step. Its CDN encryption documentation positions ECH as a platform security capability, rather than something developers implement inside a framework or project.

That distinction matters for small teams. Transport security changes can otherwise require certificate work, proxy configuration and careful compatibility testing. By implementing ECH at the CDN layer, Vercel can extend the protection across eligible deployments while preserving compatibility for browsers and networks that do not yet use it.

Adoption will still depend on the client ecosystem. Vercel points to Mozilla’s explanation of browser support, while noting that recent Chrome, Edge and Firefox releases support the extension. Visitors on unsupported clients will not receive the additional hostname privacy, although the announcement does not indicate that ordinary HTTPS connectivity will be disrupted.

For businesses handling customer portals, internal applications or other privacy-sensitive services, the change reduces one more piece of metadata exposed in transit. For everyone else, it is a quiet CDN upgrade that improves the default security posture without adding another item to the deployment checklist.

What is Vercel Encrypted Client Hello (ECH)?

Vercel Encrypted Client Hello (ECH) is CDN support for a TLS extension that encrypts the Server Name Indication sent while establishing an HTTPS connection. Instead of exposing the destination hostname, compatible connections show network observers Vercel’s shared vercel-ech.com hostname.

Which Vercel domains can use ECH?

Vercel says ECH is supported for domains managed by Vercel DNS. It is controlled at the platform level and enabled automatically where supported; the announcement does not describe a manual setting or application-code requirement.

Which browsers support ECH on Vercel?

Vercel identifies recent versions of Chrome, Edge and Firefox as supporting Encrypted Client Hello. The privacy improvement depends on client support, so visitors using other or older browsers may not use ECH.