🔏 SRI Hash Generator
Generate Subresource Integrity hashes for CDN scripts and stylesheets — sha256, sha384, sha512
About this tool
Subresource Integrity (SRI) lets the browser verify that a CDN or
third-party script hasn't been tampered with. You add an
integrity attribute with a base64-encoded cryptographic hash
to your <script> or <link> tags.
The browser computes the hash of the fetched resource and blocks execution
if it doesn't match.
This tool computes SHA-256, SHA-384, and SHA-512 hashes from a resource
URL (it fetches the content for you), a local file you drop or browse for,
or pasted script/CSS content, then gives you the ready-to-use HTML tag
with the integrity attribute and
crossorigin="anonymous".
Example: Paste
https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js
into the URL field and click Fetch → a <script> tag
with the sha384 hash appears, ready to drop into your HTML.
FAQ
What hash algorithm should I pick? ›
Use sha384 for production. It is the sweet spot: strong enough to be collision-resistant, widely supported by all modern browsers, and shorter than sha512. SHA-256 is also fine but less common in the SRI ecosystem. SHA-512 is overkill and results in a longer integrity attribute.
Can I generate SRI for a local file? ›
Yes. Drop or browse for a JS, CSS, or MJS file using the file upload area. The file is read entirely in your browser — nothing is uploaded to any server. The content is loaded into the text area and you can then click Generate to get the SRI hashes and ready-to-use HTML tags.
Why does my tag include crossorigin="anonymous"? ›
SRI requires the resource to be fetched with CORS when it is hosted on a different origin. Adding crossorigin="anonymous" tells the browser to send a CORS request without credentials. If you omit it, the browser will refuse to apply SRI and the hash check is skipped entirely.
What happens if the hash doesn't match? ›
The browser blocks the resource from loading. A script with a bad integrity hash won't execute; a stylesheet won't be applied. You'll see a warning in the DevTools Console like "Failed to find a valid digest in the 'integrity' attribute." This is a safety feature — if a CDN is compromised and serves a modified file, the browser refuses it instead of running attacker-controlled code.