SRI Hash Generator
Generate Subresource Integrity (SRI) hashes and script or link tags for a file.
Runs in your browser Your input never leaves your device.
Hashes are computed in your browser; files are never uploaded. Text pasted into the box has its line endings normalised, so use Choose a file to hash a file byte for byte. The hash must be of the exact bytes the CDN serves, browsers use only the strongest algorithm listed (extra ones only lengthen the attribute), and the CDN must send Access-Control-Allow-Origin or the browser will refuse the file.
Report a problem with this tool
About this tool
Subresource Integrity (SRI) lets a web page say what a script or stylesheet loaded from another server must look like. You add an integrity attribute holding a hash of the file; the browser downloads the file, hashes it, and refuses to use it if the hash is different, so a compromised CDN cannot slip in changed code. This tool hashes pasted text or a chosen file with sha256, sha384 (the usual choice) or sha512 using the Web Crypto API, formats the value the way browsers expect (the algorithm, a dash and the base64 hash), and gives ready-made script and link tags with crossorigin set to anonymous. You can tick several algorithms to get a space-separated list, but browsers only use the strongest one, so one is enough. The hash must be of the exact bytes the server delivers, so hash the file you will really serve, and the CDN must allow cross-origin access with an Access-Control-Allow-Origin header, otherwise the browser blocks the file. Results were compared with openssl dgst. Nothing is uploaded; the file is read and hashed on your device.
How to use it
- Paste the file contents or choose the file.
- Pick sha384 (or another algorithm).
- Enter the file URL if you want it filled into the tags.
- Copy the tag into your page and test that the file still loads.
Common problems
- The browser blocks my file after I added integrity
- The hash does not match what the server sends. Hash the exact delivered file, check for different line endings or minification, and make sure the CDN sends Access-Control-Allow-Origin.
- Which algorithm should I use?
- sha384 is the common choice. All three are supported by browsers; stronger hashes mean longer attributes.
- Does SRI work for inline scripts?
- No. SRI applies to external files. For inline scripts use a CSP hash or nonce.