TASK

Use Subresource Integrity (SRI) for external resources

SRI ensures external scripts/styles have not been tampered with by verifying their hash. Learn to generate and verify integrity attributes.

1

SRI adds an integrity attribute to <script> and <link> tags: integrity="sha384-<base64-hash>". The browser computes the hash of the downloaded resource and compares it to the integrity attribute. If they do not match, the resource is blocked. This prevents CDN compromise or MITM attacks from injecting malicious code via external resources.
2

Hash Calculator →
Compute the SHA-384 hash of the external resource (script or CSS file). Base64-encode the hash. The integrity attribute is: integrity="sha384-<base64-hash>". Use SHA-384 (not SHA-256) for SRI — it is the recommended algorithm. The crossorigin attribute is also required for SRI on cross-origin resources.
3

SHA-3 / Keccak Hash →
Alternatively, use SHA-3-256 for SRI. While SHA-384 is the standard, SHA-3 is also supported by modern browsers. Use the strongest available algorithm. The hash must be computed over the exact bytes of the resource — any modification (whitespace, minification) changes the hash.

Frequently asked questions

What happens if the SRI hash does not match?: The browser blocks the resource and reports a violation to the console. The page may break if the resource is essential. This is the desired behavior — it is better to break than to load tampered code. Monitor SRI violations and update hashes when you intentionally update the resource.
Does SRI protect against all CDN attacks?: No. SRI protects against modification of the resource content (tampering, MITM). It does not protect against: the CDN going down (use fallback), the CDN serving a different resource (wrong URL), or the CDN logging your traffic. SRI is one layer of defense — combine with HTTPS, CSP, and trusted CDNs.

Workflows that solve this

Hash content and encode as Base64

Compute a hash of the input and encode the hash digest as Base64 for compact transport.

Hash text and verify integrity

Compute a hash of the input text and compare it against an expected hash to verify integrity.

Hash text and verify with CRC32 checksum

Compute both a cryptographic SHA-256 hash and a CRC32 checksum for data integrity verification.

MD5 Hash then Base58 Encode

Compute MD5 hash then encode as Base58 for compact representation.

Multi-hash speed comparison

Hash the input and benchmark multiple hash algorithms to compare their speed and output.

Generate Password and Hash

Generate a random password then hash it for secure storage.

SHA3-256 Hash with CRC32 Checksum

Compute SHA3-256 hash then CRC32 checksum for dual integrity verification.

SHA-512 Hash then Hex Encode

Compute SHA-512 hash then encode as hex for readability.

Reverse Text and Hash

Reverse text then compute SHA-256 hash of the reversed result.

Scramble Text and Hash

Scramble text then hash the scrambled result.

Learn more

Want to understand why?

Choosing a hash algorithm: digests, password hashing, and MACs are three different jobs

A field guide to SHA-2, SHA-3, BLAKE2, MD5, bcrypt/Argon2, and HMAC — which one fits integrity checks, password storage, and message authentication, and why they are not interchangeable.

Comparing Hash Algorithms

Compare MD5, SHA-1, SHA-256, SHA-3, and BLAKE2/3 in terms of speed, security, and use cases.

ACID is the four guarantees of transactions: atomicity, consistency, isolation, and durability, ensuring reliable transaction processing.

Adler-32 is a 32-bit checksum designed by Mark Adler; faster to compute than CRC32 but slightly weaker at error detection, used for zlib compression stream integrity.

Related tools

Hash Calculator

Compute MD5, SHA-1, SHA-256, or SHA-512 hashes with hex or Base64 output. Free, private, and 100% client-side.

SHA-3 / Keccak Hash

Compute SHA-3 (224/256/384/512) and Keccak-256 hashes. Free, private, and 100% client-side.

Generate HMAC (Keyed-Hash Message Authentication Code) with SHA-1/256/512. Free, private, and 100% client-side.