Encryption has become the default for modern applications—and it continues to evolve. Through 2019–2025, encrypted traffic maintains a clear growth trajectory, driven by broad adoption of TLS 1.3 and accelerating deployment of IETF QUIC.
Figure 1. Encryption Trends in terms of Percentage of Traffic Volume
This blog summarizes observed trends from AppLogic measurements in provider networks and highlights what these shifts mean for application understanding and experience management.
Why these trends matter
Applications are increasingly complex and multiplexed. To measure experience and manage performance effectively, providers benefit from the ability to accurately and continuously identify, classify, and categorize applications and app content across the life of a session.
AppLogic supports this through continuous monitoring of top applications and daily regression testing to keep identification current as apps and protocols evolve. This market-leading focus and investment enables AppLogic to classify more than 95% of traffic into applications, even in highly encrypted environments..
QUIC: standardized, widely deployed, and still changing in real networks
QUIC was standardized as RFC 9000 (2022), but operational reality continues to shift as major applications tune their delivery stacks. Observed behavior changes over time—requiring ongoing support for patterns such as fragmentation handling, short headers, multiple QUIC headers per packet, and 0-RTT handling.
Figure 2. IETF QUIC enhancement timeline (2017–2026).
Who is driving IETF QUIC adoption?
- YouTube: transitioned from Google QUIC to standard IETF QUIC, predominantly for video delivery, while still using TCP/TLS where optimal.
- Meta applications (Facebook and Instagram): early adopters; across 2021–2022 migrated majority of the traffic to QUIC, with most delivered over the IETF version of QUIC.
- Snapchat: QUIC adoption became prominent in 2023, used extensively for API and content delivery; a smaller portion of real-time components is observed over STUN.
- Reddit: pre-2020 traffic was predominantly TCP-based and relied on Fastly for CDN infrastructure; Fastly CDNs were early adopters of QUIC; Reddit in 2026 can be described as predominantly a QUIC-first platform, with the majority of traffic delivered over QUIC.
- YouTube is the only exception where the majority of content is delivered through QUIC (with a mix of QUIC v1 and GQUIC).
- Disney+ has more than 5% unencrypted traffic delivery, while most other apps show less than 0.5% unencrypted traffic.
Video applications: mostly TLS 1.3, with two notable exceptions
For video applications, the observed norm is predominantly TCP-based encryption through TLS 1.3.
Two exceptions showing up in the trends:
- YouTube is the only exception where the majority of content is delivered through QUIC (with a mix of QUIC v1 and GQUIC).
- Disney+ has more than 5% unencrypted traffic delivery, while most other apps show less than 0.5% unencrypted traffic.
Figure 3. Video app encryption summary and exceptions (YouTube and Disney+).
Encrypted Client Hello (ECH): early signals and what they suggest
Encrypted Client Hello (ECH) encrypts the TLS Client Hello, protecting SNI and other sensitive fields (including ALPN), reducing the availability of plaintext handshake metadata on-path.
Observed in fixed networks:
- Stable 8–9% of overall traffic shows ECH readiness (ECH header present). ECH readiness does not imply the application traffic is transferred over ECH, as this can include experimental traffic too.
- From traffic with an ECH-ready flag, not more than 1% of overall traffic is unclassified by AppLogic
- ECH is now (March-2026) formalized as RFC 9849.
Figure 4. ECH Trends for readiness vs Unclassified in Percentage of traffic volume
What continues to work as encryption increases
AppLogic combines multiple identification techniques (including machine learning) and continues classification within multiplexed flows for the full duration of the session.
With continuous monitoring and ongoing protocol parsing enhancements, AppLogic maintains more than 95% application classification even as encryption and transports evolve.
To know more about how we make this happen, stay tuned and watch this space.
Key takeaways
- Encryption continues to rise, led by TLS 1.3 and IETF QUIC.
- QUIC is standardized, but field behavior continues to evolve, proving the need for ongoing classification support.
- Large applications (YouTube, Meta apps, Snapchat, Reddit) predominantly deliver over QUIC transport protocol.
- ECH signals show meaningful readiness in fixed networks while unclassified traffic remains low in the observed data.
- High classification rates remain achievable with continuous monitoring and multi-method identification, leveraging latest advancements in AI where needed.
Topics: Quality of Experience, Encryption, App QoE, App Quality of Experience
