browsers will calculate the sha256 hash of the script and compare it to the value of the integrity attribute if the values do not match, the browser will refuse to execute it. note: the shasum is written in base64 encoding, not the (more common) hex format!