Security Optional

Send a hash of the body

Send a digest, a hash of the response body, where clients may want to check it. RFC 9530 defines Content-Digest and Repr-Digest.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Compute the sha-256 and send it in the RFC 9530 format. Content-Digest covers the bytes as sent, after compression. For the uncompressed text, Unencoded-Digest is an IETF draft some agents read.

Example

HTTP/2 200
content-type: text/markdown; charset=utf-8
unencoded-digest: sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

curl -s https://example.com/index.md | openssl dgst -sha256 -binary | openssl base64

How to check

Hash the downloaded body yourself and compare.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/digest-fields.