← All Tools

HTTP Digest Authentication Header Builder

Compute an RFC 7616 / RFC 2617 Authorization: Digest … value from a server's WWW-Authenticate challenge — MD5, MD5-sess, SHA-256, SHA-256-sess, plus qop=auth and auth-int. Everything hashes locally in your browser.

1. Paste the server's challenge optional

The WWW-Authenticate line from a 401 response. Its realm, nonce, algorithm, qop, and opaque populate the form below.

2. Request & credentials

3. Authorization header

Computation steps

About HTTP Digest Auth

Digest challenges a client with a server-generated nonce. The client answers with response = H(HA1:nonce:nc:cnonce:qop:HA2), where HA1 = H(username:realm:password) and HA2 = H(method:uri) (or H(method:uri:H(body)) for qop=auth-int). -sess variants add a second hash pass over the nonces to produce a session key. The scheme predates TLS as a way to avoid sending plaintext passwords — on the wire in 2024 it should always ride inside HTTPS. RFC 7616 (2015) added SHA-256 support and deprecated bare MD5.