SRI Hash Generator
Generate a Subresource Integrity hash for a script or stylesheet.
File to hash
The file is read in your browser and never uploaded.
How this calculation works
The file contents are hashed with WebCrypto and encoded as base64, in the format the integrity attribute expects: the algorithm name, a hyphen, then the digest. SHA-384 is offered first because it is the usual choice for Subresource Integrity, striking a balance between strength and attribute length. If you supply the resource URL, the complete script or link tag is assembled, including the crossorigin attribute that cross-origin resources need.
What the results mean
- Integrity value
- The algorithm and digest, joined by a hyphen. This goes in the integrity attribute exactly as shown.
- crossorigin="anonymous"
- Required for cross-origin resources. Without it the browser cannot read enough of the response to verify it, so it blocks the load entirely.
- Bytes hashed
- The exact size that was hashed. Comparing this against the size the server reports is the quickest way to catch a mismatch before deploying.
Common problems and fixes
- The browser blocks the resource after adding integrity
- The bytes served differ from the bytes hashed. Common causes are a CDN that minifies or recompresses on the fly, a URL pointing at a moving tag such as latest rather than a fixed version, and a file that was saved with different line endings. Download the file from the exact URL you will reference, hash that, and pin the URL to an immutable version.
- It works locally and fails from the CDN
- Check for the crossorigin attribute first, since a cross-origin resource without it fails verification regardless of the hash. Then confirm the CDN sends the right CORS header, because verification needs the response to be readable. Both have to be right before the hash is even considered.
Frequently asked questions
Which hash algorithm should I use?
SHA-384 is the common choice and what most CDNs publish. SHA-256 is also allowed and produces a shorter attribute; SHA-512 is stronger and longer. You can supply several space-separated values and the browser uses the strongest it supports, which is useful during a migration.
What does Subresource Integrity actually protect against?
A resource being changed between the server and your page: a compromised CDN, a hijacked package, or an intermediary altering the file. It does not protect against a library that was malicious when you hashed it, and it does not help if you update the hash without checking what changed.
Does it work on images or fonts?
No. The integrity attribute applies to script and link elements only. Other resource types have no equivalent, which is one reason a Content Security Policy is worth having alongside rather than instead.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/sri-hash-generator/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="SRI Hash Generator" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/sri-hash-generator/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.