echtool

Probe ECH (Encrypted Client Hello) deployments with customizable ECH configurations. The full feature set is available in echtool CLI.

Probe configuration

Test

Transport

Target domain

ECH configuration (base64)

Public name / SNI override

Config ID (0-255)

ECH version

Max name length

Cipher suites (comma-separated, e.g. SHA256/AES128GCM)

ALPN (comma-separated)

DNS server (host:port)

Insecure (skip certificate verification)

Validate first RetryConfiguration

Validate all RetryConfigurations