Does HTTPS hide the domain name of the site I'm visiting from my ISP?

No. The name of the site you asked for leaves your machine in readable form twice before any encryption exists: once in the lookup that turns the name into an address, and once in the opening message of the handshake, which has to name the site so the server can choose the right certificate. What is encrypted is everything after that point, including which page of the site you opened. The host is known before the lock ever appears.

Watch a visit happen in order. Your machine asks a resolver to turn a name into an address, and nothing is encrypted at that moment, because no secure channel to the resolver has been established yet. The resolver is by default the one your network handed to your machine, which on a home connection is your ISP's. The name is not sent as a pretty string either: DNS writes each label with a one byte length in front of it and closes the whole thing with a zero byte. For a thirteen character name made of www, example and com that comes to $(3+1)+(7+1)+(3+1)=16$ bytes, plus the closing zero, so 17 bytes, every one of them legible to the resolver and to anything sitting on the path between you and it.

A few milliseconds later your machine opens a connection to the returned address and sends the first handshake message. That message names the site again, in the same length prefixed format, inside an extension called server_name, and again in the clear. It has to be there. A single address commonly hosts thousands of sites, so the server cannot pick a certificate until it knows which site is wanted, and no key has been agreed yet that could encrypt anything.

The natural guess is that the padlock covers the address, because the browser prints the whole name beside it. The browser prints the name because it already knows it: you typed it, or it came out of a bookmark. The padlock is a statement about the certificate, which binds a public key to that name and is signed by somebody your machine has decided to trust. It says the party you reached holds the key for that name. It says nothing about who was listening when the name was asked for and answered. A watcher who saw the lookup and the handshake knows exactly which site you are on, and still cannot read a single byte of what you sent it.

None of this needs a broken cipher, which is the part that unsettles people. Packet sizes are enough by themselves. A page of 240 kilobytes returned as 31 packets averages $240 \div 31 \approx 7.7$ kilobytes per packet, and that sequence of sizes, in order, is a signature: an attacker loads the same site, records the signature of every page, and matches yours against the list. The defence exists and is called padding. It costs bandwidth roughly in proportion to how much it hides, which is why almost nobody turns on enough of it to matter.

The sharper version attacks what you type. An interface that fires a request per keystroke produces one small packet per character and a reply whose size depends on how many suggestions matched, which depends on the character. The sizes alone recover the word. The general rule: any feature that turns your input into differently sized traffic leaks that input, and encryption does not help, because the leak is in the size and not in the content. What encryption does stop is tampering. A watcher cannot flip a bit in a page without the change being detected and the connection dropped, and that half of the guarantee matters every day.

The handshake leak now has a fix, and it comes with a precondition that catches people out. Encrypted client hello has the hosting provider publish a public key in DNS; your browser encrypts the name to that key and only the server can open it. But the key arrived in the DNS record, so if the lookup is still plain text the watcher reads the name there instead and the effort buys nothing at all. The lookup has to be encrypted first, over HTTPS or over TLS to a resolver you chose deliberately, and the site or its content network has to support the encrypted handshake. Where either piece is missing the name is still on the wire, and one leak is as good as two.

The address itself never goes away, and it carries some of what the name would have given. A site with an address of its own is one reverse lookup from its name, a single query to a public service. A site behind shared hosting or a content network gives away the provider rather than the site, which is why the large providers are the ones deploying encrypted hellos: they have the scale to publish the keys and the interest in stopping watchers from enumerating their tenants. A VPN moves the observation to the VPN operator rather than removing it, and Tor hides the destination from your network and from the relays but not from the exit node. Even with the name fully hidden, sizes and timings still answer the question of which page you opened, which is the part padding was meant to fix and largely has not.