Web Security

Subresource Integrity (SRI) Hash Generator

Generates a Subresource Integrity hash and the full integrity attribute from pasted file contents, using Web Crypto.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the exact contents of the .js or .css file you load from a CDN.
  2. Pick a digest algorithm if you need something other than the SHA-384 default.
  3. Select Generate hash and copy the integrity attribute, or the whole example tag, into your page.
  4. Regenerate the hash whenever the file changes - a mismatch makes the browser refuse to load it.

What sri hash generator does

Subresource Integrity lets a page pin the exact contents of a script or stylesheet it loads from a CDN, so a tampered file is refused rather than run. The attribute is fussy: a specific digest, base64 rather than hex, and an algorithm prefix the browser reads. Get any part wrong and the browser blocks a file that was perfectly fine, which is why hand-building the value goes badly.

Paste the exact contents of the file and this computes the digest with the browser Web Crypto API and writes out the whole integrity attribute, plus example script and link tags ready to paste. The hash must match the file byte for byte, so regenerate it whenever the file changes. It runs entirely in your browser - nothing you paste is sent anywhere, and this tool does not contact, scan or attack any website. Only review systems you own or are authorised to assess.

Frequently asked questions

Subresource Integrity uses a specific set of digests, base64 rather than hex encoding, and an algorithm-prefixed form the browser reads from an integrity attribute. This tool produces that exact attribute, ready to paste, rather than a bare hash you would then have to reformat.

SHA-384 is the common default and is offered first. SHA-256 and SHA-512 are also valid for SRI. Any of them is fine; the important thing is that the hash matches the file exactly.

Because the hash no longer matches the file, byte for byte. The most common cause is that the file changed - even a rebuild that alters a comment. Regenerate the hash from the current file contents, and keep crossorigin="anonymous" on cross-origin resources.