Android 17 encrypts the one part of a secure connection that has always leaked in plain text: the name of the site you are connecting to. Google’s own developer documentation states it flatly — “In Android 17 (API level 37) and higher, ECH is supported by default.” Encrypted Client Hello closes a gap that has existed since HTTPS became the norm, and it does so at the platform level rather than one browser at a time.
What Encrypted Client Hello actually hides
When your phone opens an HTTPS connection, the contents are encrypted but the opening handshake carries a field called Server Name Indication — effectively “I would like to talk to example.com” — in the clear. Everything on the path between you and the server can read it: your ISP, your mobile operator, whoever runs the Wi-Fi at the airport. The page is private; the fact that you asked for it is not.
ECH is a TLS extension that encrypts that field. Google’s documentation describes it as preventing network intermediaries from seeing the hostnames an app connects to. In practice, an observer on the network sees that you connected to a content delivery network — Cloudflare, say — and how much data moved, but not which of the millions of sites behind it you were reading.
What it does not hide
This is worth being blunt about, because “encrypted browsing” claims tend to get oversold. ECH conceals the hostname from the network path. It does not hide your traffic from the site itself, from the CDN terminating the connection, or from any app you are logged into. It does not make you anonymous, it is not a VPN, and it does nothing about the tracking that happens inside the page once it loads. What it removes is one specific, long-standing leak: a passive list of every domain your phone touched, readable by whoever carries your packets.
Default on, with an asterisk developers control
“Supported by default” is doing precise work in Google’s sentence, and it is not the same as “on for everything you do.” Per the same documentation, ECH is enabled for all domains if the app’s networking library supports it — and Google’s page says support is coming soon in OkHttp and HttpEngine, two of the most widely used networking stacks on Android. 9to5Google’s write-up instead tells developers to upgrade to OkHttp 5.5.0 and enable ECH. Those two statements do not sit comfortably together, and we have not been able to reconcile them; Google’s own page is the more authoritative of the two, but it also carries a last-modified date of 6 August, ahead of this week’s announcement, so it may simply be behind.
Either way, the practical reading for users is the same: this arrives app by app as libraries update, not all at once the day you install Android 17. The other clause worth knowing is that apps can opt out. The documentation describes a Network Security Config element that lets an app disable or enforce ECH for its own connections — so an app that would rather its destinations stay visible on the network can say so, and you will not be prompted about it.
Carriers can now switch 2G off for you
The second change in Android 17 is aimed at a different attack. 9to5Google, Engadget and BleepingComputer all report, from a Google blog post published on 27 August, that Android 17 lets mobile operators turn 2G connectivity off by default for their subscribers, rather than leaving it as a setting each user has to find. Android 12 introduced that toggle for individuals; this hands the switch to the network.
The target is SMS blasters — kit that forces nearby phones to drop their LTE or 5G connection and fall back to legacy 2G, where messages can be injected past modern spam filtering and traffic is far easier to intercept. Killing 2G at the carrier level removes the downgrade path for everyone on that network at once, which is a much better outcome than hoping millions of people dig through Settings.
It also means the decision is no longer yours. For the overwhelming majority of people in markets where 2G is dead weight, that is a straightforward security win. It is a genuine trade-off in places where 2G is still the only signal in rural coverage gaps or the fallback older handsets rely on, and Android 17 puts that call in the operator’s hands rather than the user’s.
What you should do
Nothing, mostly — and that is the point of a platform-level change. There is no setting to enable, no app to install, and no way for you to force an app whose networking library has not caught up. If you want more than ECH gives you today, the pairing that helps is encrypted DNS, since your DNS lookups are the other place your browsing history leaks in plain text, and that one is under your control in Android’s Private DNS settings.
Google’s Encrypted Client Hello documentation is the source for the ECH behaviour above. Sources for the carrier 2G change: 9to5Google, Engadget, BleepingComputer
