Build

Hash Generator — MD5, SHA-1, SHA-256 and Friends

A hash reduces any input to a fixed-length fingerprint, where the same input always produces the same output and any change produces a completely different one. This generates them across the common algorithms, which matters because the choice is not a matter of taste — some of them are broken for security purposes and fine for others.

When it helps

Integrity checking is the everyday use: confirming a downloaded file matches its published checksum, or that two files whose contents you cannot easily compare are actually identical. Subresource integrity attributes for third-party scripts are a hash, and they are one of the few genuinely effective defences against a compromised CDN serving altered code. Cache keys and deduplication use them for reasons that have nothing to do with security at all.

Worth running automatically

Hashing third-party scripts and checking them on a schedule is the practical control here, because a supply-chain compromise changes the file without changing the URL. Nothing in your monitoring notices a script whose contents were replaced. Comparing a hash of what is actually served against a known-good value catches exactly that, and it is one of the few checks that detects a compromise rather than an outage. Worth stating plainly: MD5 and SHA-1 are unsuitable for any security purpose, though they remain fine for deduplication.

What you get out of it

A reliable fingerprint for integrity checking, and the basis of a genuine defence against altered third-party code — which most monitoring never looks for at all.

Also in Build