SRI Hash Generator

How to use the SRI Hash Generator

Paste the exact contents of your .js or .css file, or upload the file with the file picker.

Pick a Hash: SHA-384 (recommended), SHA-256, SHA-512 or All three.

Optionally enter the File URL for the tag and choose the Tag type, or leave it on Detect from URL.

Click Generate integrity and copy the integrity value or the complete tag into your HTML.

SRI hash generator for scripts and stylesheets

This SRI hash generator computes the Subresource Integrity value for a JavaScript or CSS file and wraps it in a ready-to-use HTML tag. You paste the file contents (or upload the file itself), choose a digest, and get a string such as sha384-… plus a <script> or <link rel="stylesheet"> element with the integrity and crossorigin attributes already filled in.

What is Subresource Integrity?

Subresource Integrity (SRI) is a W3C browser feature that lets you pin a third-party file to an exact version. When you load a library from a CDN, you are trusting that server to keep serving the same bytes. If the CDN is compromised or the file changes, every site that includes it runs the new code.

With SRI you add a cryptographic hash of the expected file to the tag. Before executing the script or applying the stylesheet, the browser hashes what it downloaded and compares. If the digests differ, the resource is blocked and a console error is logged, so a tampered file never runs.

Example

Using the sample file from the tool with the default SHA-384 option and the URL https://cdn.example.com/lib/app.min.js, the output is:

sha384-5THHiNTcO4NqmiMOyQLTJlh4rdCraN1xWjw7oVCB6VWQVfLzX2a3QocOQ7xApux8

<script src="https://cdn.example.com/lib/app.min.js"
  integrity="sha384-5THHiNTcO4NqmiMOyQLTJlh4rdCraN1xWjw7oVCB6VWQVfLzX2a3QocOQ7xApux8"
  crossorigin="anonymous"></script>

The integrity value is the algorithm name, a hyphen, and the Base64 (not hex) encoding of the raw digest. That is why an SRI string looks different from the output of a regular SHA-384 hash generator, which usually prints hex.

Options explained

Hash – SHA-384 is the common default and is what most CDNs publish. SHA-256 and SHA-512 are also valid. All three puts several space-separated hashes in one attribute; browsers use the strongest algorithm they support.
File URL for the tag – the src or href written into the generated tag. It is only used for the markup, not fetched.
Tag – Detect from URL produces a <link rel="stylesheet"> when the URL ends in .css and a <script> otherwise. You can force either one.

The status bar reports how many bytes were hashed, which is a quick sanity check that you pasted the whole file.

Why crossorigin="anonymous" matters

Browsers only perform integrity checks on cross-origin files that are fetched in CORS mode. The generated tag therefore always includes crossorigin="anonymous". The CDN must also answer with an Access-Control-Allow-Origin header; major public CDNs do, but a self-hosted asset bucket may need that header configured before SRI works.

Common errors and fixes

"Failed to find a valid digest in the integrity attribute" – the bytes differ from what you hashed. Upload the exact file the CDN serves rather than a copy you reformatted, minified or saved with different line endings. A single changed newline produces a different hash.
Pasted text vs. uploaded file – pasting converts the text to UTF-8 and may drop a byte order mark or change CRLF to LF. When in doubt, use the upload option so the original bytes are hashed.
Floating versions – URLs such as @latest or /lib/v3/ can change contents at any time, breaking the hash. Pin an exact version.
CORS blocked – if the server does not send CORS headers, the resource fails even when the hash is correct.

When to use SRI

Add integrity attributes to any script or stylesheet loaded from a domain you do not control. It pairs well with a Content Security Policy; you can review your policy with the CSP evaluator. For first-party files served from your own origin, SRI adds little because an attacker who can change the file can usually change the HTML too.

Privacy

Hashing uses the browser's built-in WebCrypto API. Your file is read locally and is never uploaded to our server, so you can safely hash private bundles before deploying them.

Frequently asked questions

Should I use sha256, sha384 or sha512 for SRI?

All three are supported by current browsers and none is known to be weak. SHA-384 is the conventional choice and matches what most CDNs publish. If you list several hashes, the browser picks the strongest algorithm it understands.

Why does my SRI hash not match the one on the CDN?

The file you hashed is not byte-for-byte identical to the file the CDN serves. Different line endings, a missing trailing newline or a re-minified copy all change the digest. Download the exact file from the CDN URL and upload it here.

Does SRI work for files on my own domain?

Yes, the attribute works for same-origin files and crossorigin is not required there. It is most valuable for third-party CDNs, though, because anyone able to modify files on your own server can usually modify the page that references them as well.

Can I use SRI with dynamically imported modules or fonts?

Integrity is supported on script and link elements, including module scripts and modulepreload links. Fonts loaded via CSS @font-face and images do not support the integrity attribute.

Is the integrity value a hex hash?

No. It is the algorithm prefix followed by the Base64 encoding of the raw digest bytes. A hex digest of the same file contains identical information but will not be accepted by the browser in the integrity attribute.