SRI Hash Generator

Create integrity hashes so browsers only run the exact file you expect

Content from

File URL (for the tag)

Content of the file

Tag

SHA-256

SHA-384

SHA-512

Add crossorigin="anonymous"

Integrity value

HTML tag

Check an existing integrity attribute against this content

Error

There is nothing to copy yet.

SHA-256, 384 and 512

Choose one or several algorithms. Browsers accept all three and use the strongest hash you list.

Ready-to-Paste Tag

Get a complete script or link tag with the integrity and crossorigin attributes already filled in.

Verify an Attribute

Paste an integrity attribute you already use and see whether the content really matches it.

Private

Hashes are calculated in your browser with the Web Crypto API. Your file is never uploaded.

What Subresource Integrity Protects Against

When a page loads a script or stylesheet from a CDN or another site, it trusts whatever that server sends. If the file is replaced, whether by a hacked CDN or a compromised package, every visitor runs the attacker’s code. The integrity attribute holds a cryptographic hash of the file you expect. The browser downloads the file, hashes it, and refuses to use it unless the hash matches.

An integrity value looks like sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC. Cross-origin files also need crossorigin="anonymous", otherwise the browser cannot check them. The hash covers the exact bytes, so even a changed line ending breaks it: hash the file as the server delivers it. Use a fixed version of a library, not a "latest" URL, because a URL whose content changes will fail the check.

Key Takeaways

Checked against OpenSSL: The values were compared with openssl dgst on test files for all three algorithms.
Only for fixed files: SRI works for files that never change. If the file is updated, regenerate the hash.
Related tools: Use the Hash Generator for other digests and the CSP Header Generator to restrict where scripts may load from.

Related Tools

Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text, computed locally with the Web Crypto API. Free and runs entirely in your browser.

CSP Header Generator

Build a Content-Security-Policy header string from a checklist of common directives. Free and runs entirely in your browser.

Security Headers Analyzer

Check a website's HTTP security headers (HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin headers, cookies) and get a grade from A+ to F with plain-language advice. Or paste headers you already have.

Learn more

How-to

How to Add Subresource Integrity to Scripts and Stylesheets

Protect your pages from a tampered CDN file: hash the exact file, add the integrity and crossorigin attributes.

Cheat sheet

OpenSSL Commands Cheat Sheet

The OpenSSL commands people actually use: hashes and random bytes, keys, certificate requests, reading certificates.

Glossary

Subresource Integrity (SRI)

Subresource Integrity is a browser feature that checks a script or stylesheet against a hash you supply and refuses to use it if the file.

SRI Hash Generator - Subresource Integrity for Scripts and Stylesheets