Generate SRI hash

Create a Subresource Integrity hash for a script or stylesheet’s exact bytes.

freeworks offlinenothing uploaded
ToolSRI Hash Generator
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

Resource bytes are hashed with SHA-256, SHA-384, or SHA-512 and Base64 encoded into an integrity token; crossorigin is included when needed. Browsers compare fetched bytes to the digest before applying the resource.

  • SHA-384 balances digest size and compatibility.
  • Multiple hashes can support staged asset versions.

Worked example

Generate SRI hash for JavaScript content
Compute SHA-384 integrity hash for a script with ready-to-use HTML tags
Input
											console.log('Hello, World!');
Output
												# Subresource Integrity Hash

Integrity: sha384-AbXMBJEf72gjQYPpnzblmu6EMIjgH7+GKr1dqa+zMcargkw+4UwBZhjbltwmSfcI

# SHA-256: sha256-VrXiRzNabZlVUzrPKgON5EtG2BuRUP8wULVkbIOqqkA=
# SHA-384: sha384-AbXMBJEf72gjQYPpnzblmu6EMIjgH7+GKr1dqa+zMcargkw+4UwBZhjbltwmSfcI
# SHA-512: sha512-NPJXEZdKRVSg+mZDCNsuCXB4f8Rh3GOLcDlrR6mmDYeJVNgb9sgVc3We3eE5SNdIMzcK9PnrRKPschwvl45Ibg==

# Script Tag
<script src="URL" integrity="sha384-AbXMBJEf72gjQYPpnzblmu6EMIjgH7+GKr1dqa+zMcargkw+4UwBZhjbltwmSfcI" crossorigin="anonymous"></script>

# Stylesheet Tag
<link rel="stylesheet" href="URL" integrity="sha384-AbXMBJEf72gjQYPpnzblmu6EMIjgH7+GKr1dqa+zMcargkw+4UwBZhjbltwmSfcI" crossorigin="anonymous">

When to use this

CDN scripts, build pipelines, and third-party asset reviews generate SRI.

Edge cases

  • One changed byte blocks the resource.
  • Hashing compressed transfer bytes gives the wrong token.
  • Cross-origin resources may need CORS headers.

References