---
title: "Send a hash of the body · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/digest-fields
updated: 2026-10-20
licence: "All rights reserved"
---

# Send a hash of the body

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Send a digest, a hash of the response body, where clients may want to check it. RFC 9530 defines `Content-Digest` and `Repr-Digest`.
- How: Compute the `sha-256` and send it in the RFC 9530 format. `Content-Digest` covers the bytes as sent, after compression. For the uncompressed text, `Unencoded-Digest` is an IETF draft some agents read.
- Check: Hash the downloaded body yourself and compare.

Example:

```http
HTTP/2 200
content-type: text/markdown; charset=utf-8
unencoded-digest: sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:
```

```sh
curl -s https://example.com/index.md | openssl dgst -sha256 -binary | openssl base64
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/digest-fields`.

- Previous: [Lock scripts to a known hash](https://agentwranglers.se/playbook/website/security/subresource-integrity)
- Next: [Lock down risky DOM writes](https://agentwranglers.se/playbook/website/security/trusted-types)
- [Security](https://agentwranglers.se/playbook/website/security)