What should we check?

Check my device IP, provider, speed and VPN leaks

Check this Type a site, domain, IP or subnet

All tools

GuidesEvery CheckNet check has a guide: what it is, why it matters and how to fix it, step by step.

My device

Your IP …

Checks

Speed testDownload, upload and ping Open port on my IPCan the outside reach your device or router? My IP’s networkNetwork owner and reverse name

More details

This connection

This device

This is what Cloudflare sees of this connection. Nothing is stored.

Same as JSON Just the IP (for curl)

Your request headers

Speed test

Measured to the nearest Cloudflare data centre, with no other service involved. On a fast connection it uses up to about 200 MB of data.

Ping–ms

Download–Mbps

Upload–Mbps

Guide: slow internet, high ping and jitter

Is it blocked?

The site is opened from networks inside the country and from outside it, next to OONI’s figures for the last month.

Does it open everywhere?

We open the site from several countries, so you can see whether it is reachable everywhere.

Port check

Timed from the Cloudflare data centre nearest to you, not from your device. Common ports only.

Ping and route

Ping tells you how far away a host is; traceroute and MTR show the path hop by hop. It runs from places around the world, not from your device.

Ping Traceroute MTR

DNS

Domain records, DNS and email health, and DNS answers from around the world.

Domain info

Registrar, registration and expiry dates and name servers, from RDAP.

SSL certificate

Check a site’s certificate, or read a certificate (PEM).

Have a certificate (PEM)?

Certificate in PEM (a chain is fine)

IP lookup

The network owner, country, abuse contact and reverse name (PTR) of an IP.

Encode and decode

Everything runs in this browser; nothing you type here is sent anywhere.

Format

Input

Result

Subnet calculator

Type an IP with a prefix or a mask, like 192.168.1.10/24, or a number to turn into an IP.

Speed units

Providers sell megabits per second; browsers show downloads in megabytes.

Value Unit

Guides

Every CheckNet check has a guide: what it is, why it matters and how to fix it, step by step.

The site name on the wire (SNI) and hiding it (ECH)

How your provider sees which site you connect to, and how that can be hidden.

Check it with CheckNet: My device

What is the site name on the wire (SNI)?

When you connect to a site over HTTPS, the page content is encrypted, but in the very first message of the connection, the “ClientHello”, the browser sends the site’s name so the server knows which certificate to show. That name, the SNI, is usually sent in the clear. So your internet provider, the Wi-Fi owner or anyone on the path can see which site you connect to, though not what you do there.

Why it matters

The plain site name matters both for privacy and for filtering: many filtering systems read this name in the first message and cut the connection if it is on their list. Encrypting DNS alone does not fix this, because the site name is still visible in the SNI.

What ECH does

Encrypted Client Hello (ECH) encrypts the sensitive part of the first message, including the site name, with a key the site publishes in DNS. An outside observer sees only the name of a shared front server, such as Cloudflare’s public one, not the real site. It takes both sides: the browser must support ECH and the site must have it turned on. Cloudflare offers ECH for sites on its network; most other sites do not have it yet.

Turn on secure DNS in your browser

The browser gets the ECH key from the site’s HTTPS record in DNS. Firefox and Chrome support ECH, and with secure DNS (DNS over HTTPS) that record reaches the browser more reliably and untampered.

In Chrome: the three-dot menu, then Settings, then Privacy and security, then Security. Under “Advanced”, turn on “Use secure DNS” and pick a provider. If the device is managed by an organisation or parental controls are on, the option is not available.
In Firefox: open Settings, type “DNS over HTTPS” in its search box, then raise the protection level and pick a provider.
Update the browser; ECH support arrived in recent versions.
Close and reopen the browser so the new setting applies to every connection.
Open CheckNet’s “My device” page and look at the “Site name (SNI) on the wire” row.

If secure DNS does not work on your network, sites may fail to open. Then pick another provider or turn the option off.

Check again with CheckNet

CheckNet runs on Cloudflare and reads this row from Cloudflare’s own report. “Encrypted (ECH)” means CheckNet’s name was hidden in the first message. “In the clear” means the browser did not send ECH; for example because it is outdated, or because the network’s DNS did not pass on the site’s HTTPS record. Networks can block ECH that way, and secure DNS prevents it. The result is for this connection only; a site without ECH always sends its name in the clear.

More guides

Page not found.

Go home