TASK

Prevent CSRF (Cross-Site Request Forgery) attacks

CSRF tricks authenticated users into submitting unwanted requests. Learn anti-CSRF tokens, SameSite cookies, and double-submit patterns.

1

CSRF exploits the browser's automatic sending of cookies. If a user is logged in (cookies present) and visits a malicious site, that site can submit a form to the target site — the cookies are sent automatically. Prevention: (1) Anti-CSRF tokens (synchronizer pattern) — a random token in the form and session, verified on submission. (2) SameSite cookies — cookies are not sent cross-site. (3) Origin/Referer header validation. (4) Require custom headers for state-changing requests.
2

HMAC Generator →
Generate an anti-CSRF token. The token should be: unpredictable (CSPRNG), per-session (or per-request for higher security), and bound to the user's session. HMAC(session_id, random) is a common pattern — it is deterministic (same session → same token) but unforgeable without the secret.
3

Hash Calculator →
For the double-submit pattern: generate a random token, set it as a cookie (not HttpOnly, so JavaScript can read it) and include it as a header in every request. The server verifies that the cookie and header match. This does not require server-side state. Use SHA-256 for the token hash.

Frequently asked questions

Are SameSite cookies enough to prevent CSRF?: SameSite=Lax (default in modern browsers) prevents CSRF for top-level navigations (form POST, link clicks) but allows GET requests. SameSite=Strict prevents all cross-site sending but breaks legitimate cross-site usage (e.g., following a link to your site from email). Use SameSite=Lax + CSRF tokens for defense in depth.
CSRF vs XSS — what is the difference?: XSS executes malicious code in the victim's browser (the attacker reads data or performs actions as the user). CSRF tricks the victim's browser into making a request to a site where they are authenticated (the attacker does not read the response). XSS is a code injection; CSRF is a request forgery. XSS can bypass CSRF protections (the script can read the token).

Workflows that solve this

Hash content and encode as Base64

Compute a hash of the input and encode the hash digest as Base64 for compact transport.

Hash text and verify integrity

Compute a hash of the input text and compare it against an expected hash to verify integrity.

Hash text and verify with CRC32 checksum

Compute both a cryptographic SHA-256 hash and a CRC32 checksum for data integrity verification.

HMAC Sign then Base64 Encode

Generate HMAC signature then Base64-encode for API auth headers.

HMAC sign and verify

Generate an HMAC signature for a message and verify it against an expected signature.

HMAC-sign an API request string

Generate an HMAC-SHA256 signature for a request payload to authenticate API calls.

MD5 Hash then Base58 Encode

Compute MD5 hash then encode as Base58 for compact representation.

Multi-hash speed comparison

Hash the input and benchmark multiple hash algorithms to compare their speed and output.

Generate Password and Hash

Generate a random password then hash it for secure storage.

SHA3-256 Hash with CRC32 Checksum

Compute SHA3-256 hash then CRC32 checksum for dual integrity verification.

SHA-512 Hash then Hex Encode

Compute SHA-512 hash then encode as hex for readability.

Reverse Text and Hash

Reverse text then compute SHA-256 hash of the reversed result.

Scramble Text and Hash

Scramble text then hash the scrambled result.

Learn more

Want to understand why?

Choosing a hash algorithm: digests, password hashing, and MACs are three different jobs

A field guide to SHA-2, SHA-3, BLAKE2, MD5, bcrypt/Argon2, and HMAC — which one fits integrity checks, password storage, and message authentication, and why they are not interchangeable.

How to Chain Encoding and Hashing Workflows

Real data-processing tasks rarely use a single tool. This tutorial shows how to compose encoding and hashing tools into multi-step pipelines: a base64-to-hash-to-hex verification chain, parallel multi-algorithm integrity checking, and an automatic encoding-format conversion chain. Each pattern maps to an existing workflow recipe (base64-encode-decode-verify, hmac-sign-verify) and explains when to use inline tool chaining versus a saved recipe.

BLAKE3 Keyed Mode

The BLAKE3 keyed mode is BLAKE3's MAC mode: a 32-byte key is injected into the initial state to produce a keyed message authentication code.

A hash chain is a sequence obtained by repeatedly hashing the same value, h^0=x, h^i=H(h^{i-1}), used for one-time passwords and lightweight authentication.

Related tools

Generate HMAC (Keyed-Hash Message Authentication Code) with SHA-1/256/512. Free, private, and 100% client-side.

Hash Calculator

Compute MD5, SHA-1, SHA-256, or SHA-512 hashes with hex or Base64 output. Free, private, and 100% client-side.

Random Bytes Generator

Generate cryptographically secure random bytes or integers. Free, private, and 100% client-side.