SNI
The field in a TLS handshake that names which site you are connecting to, sent in the clear and readable by anyone on the path including a proxy.
Server Name Indication is the part of a TLS handshake that solves a hosting problem and creates a privacy one. Because many sites share a single address, a server needs to know which certificate to present before encryption is set up, so the client names the target hostname in the opening ClientHello. That works perfectly, and it means the one piece of a TLS connection that says where you are going travels in plaintext, before the encryption everyone assumes protects it.
The consequence connects several other entries. Even when a proxy only tunnels your HTTPS traffic and cannot read it, the SNI in the handshake tells the operator, and anyone else watching the path, which hostname you asked for. It is the same fact the CONNECT line exposes, arriving by a second route, and it is why the destination of encrypted traffic is metadata that leaks while the contents do not.
There is an active effort to close the gap, and it is worth knowing where it stands. Encrypted SNI and its successor, Encrypted Client Hello, encrypt this field so the hostname no longer travels in the clear. Deployment is real but uneven, depending on the site, the network and the client all supporting it, so for most traffic today the assumption should remain that the hostname is visible even when nothing else is.
SNI also has a detection dimension that matters for proxy work. Because the hostname is visible, network-level filters and censorship systems use it to decide what to block without decrypting anything, and some defences check whether the SNI a client sends is consistent with the rest of its behaviour. A handshake whose SNI, TLS fingerprint and later requests disagree is one more contradiction, which is the recurring way traffic gets identified regardless of how clean the address is.
Frequently asked questions
Can a proxy see which website I visit over HTTPS?
The hostname, yes, even when it cannot read the content. The Server Name Indication field in the TLS handshake names the target site and is sent in the clear before encryption begins, so a tunnelling proxy sees it just as it sees the CONNECT target. The page contents stay encrypted; where you went does not, unless Encrypted Client Hello is in use.
What is encrypted SNI?
An extension that encrypts the hostname field so it no longer travels in plaintext, with Encrypted Client Hello being the current form of the idea. It closes the leak that lets networks and operators see which site you reached inside an otherwise encrypted connection. Support depends on the site, the client and the network all cooperating, so coverage today is partial.
Why does SNI matter for scraping or unblocking?
Because it is read before anything is decrypted. Network filters use the visible hostname to block or allow connections without inspecting content, and some anti-bot systems check that the SNI is consistent with the client's other signals. A mismatch between SNI, TLS fingerprint and subsequent requests is exactly the kind of inconsistency detection looks for.
Back to the full glossary.