Definition
Even on HTTPS, the opening 'Client Hello' message traditionally included the destination hostname in plain text (SNI). ECH, developed in the IETF TLS working group as the successor to Encrypted SNI, hides that name inside an encrypted inner message.
How it works
The browser fetches the site's ECH public key, usually from a DNS HTTPS record, then sends an outer Client Hello naming a shared front-end provider and an encrypted inner one naming the real site. Firefox and Chrome support ECH, and some CDNs such as Cloudflare enable it for sites they host.
Why it matters
ECH closes one of the last gaps that let ISPs and Wi-Fi operators see which websites you visit over HTTPS. It only works when both the browser and the site support it, and DNS must be encrypted too, so a VPN is still the simpler way to hide all destinations at once.