Download websites that use Digest

About Digest

Digest is one of the entries in our Security group where the label describes a mechanism rather than a single vendor's product. The address our record carries points at the published internet standard for the Digest HTTP authentication scheme, the arrangement where a server refuses a request and challenges the client to prove it knows a password without sending that password across the wire. The client answers with a hash computed over the challenge value, the user name, the password, the request method and the path, and the server recomputes the same hash to decide whether the request goes through. Because the challenge is offered to anyone who asks, before any credential exists, the scheme is observable from outside at all. A domain lands in this bucket because a response asked for credentials that way, not because a site owner went shopping for something called Digest.

The security reading is what makes the signal worth having. Hashing the password rather than encoding it improved on the plainer scheme this one was written to replace, but the server must still hold credentials in a form it can recompute, the exchange offers nothing against an attacker sitting in the middle of a connection that is not already encrypted, and captured digests are open to offline guessing. What the sites in the group share is a posture rather than an industry. Something on the domain is closed off by a prompt the server raises itself rather than by a login page built into an application, which is the older and plainer way to protect a directory, an administrative area or a staging copy nobody meant to leave reachable. Embedded equipment carries much of it, since routers, storage boxes, cameras and print servers ship with a prompt of this kind on their management interface and often end up answering on a public address.

Honesty about the count matters here. As of October 2026 we record Digest on 437 sites. The figure is a floor rather than a census, because a host appears only where it presents the challenge on a path we actually reach, and anything behind a proxy that terminates authentication or wrapped in an application login stays invisible while the scheme runs underneath. The vendor and licence columns for this entry are empty and will stay empty, so a row records that a prompt of this shape was seen rather than which software produced it.

A per domain lookup answers a question you already hold: someone hands you a URL and you want to know how it challenges for credentials. The downloadable list answers the opposite question, the one that is far harder to ask by hand. Give me every host still presenting this prompt to the open internet, with the server software underneath, the country and the top level domain beside it, and let me sort by whichever of those matters today. Inverting the question that way, from one host at a time to a whole population in a single file, is the practical route to mapping exposed administrative surfaces, auditing what a hosting customer base leaves reachable, or watching the exposure shrink or persist between crawls.