By · Updated

SRI Hash Generator

sha384, sha256 and sha512 Integrity Hashes for CDN Scripts and Stylesheets

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the SRI Hash Generator works

This SRI hash generator produces the integrity value for a script or stylesheet, so a browser refuses the file if a CDN or attacker changes it. Paste the file's contents or choose it from disk, add the URL it loads from, and copy a finished script or link tag. Hashing runs in your browser.

How the SRI hash generator works

Subresource Integrity is an attribute like integrity="sha384-oqVuAfXRKap7…". It is the algorithm name followed by the Base64 digest of the file's exact bytes. When the browser downloads the file it hashes it too, and if the values differ the file is blocked and an error appears in the console. The tool uses the same Web Crypto digest the browser uses.

The crossorigin attribute

Files from another origin must be fetched with CORS for the browser to check their integrity, so the tag includes crossorigin="anonymous". The server must reply with an Access-Control-Allow-Origin header; public CDNs do. Without it the file is blocked even when the hash matches.

When the hash must change

Any change to the file, including a minified rebuild or a new version, changes the hash. Pin CDN URLs to an exact version, never latest, and regenerate the integrity value whenever you upgrade. An SRI value on a file that changes on its own will break your page.

FAQ

Which algorithm should I choose?

sha384 is the common default and what most CDNs publish. sha256 and sha512 are equally supported by browsers. You can list several values separated by spaces and the browser uses the strongest one it knows, but a single sha384 value is enough for almost every site.

Should I paste the file or choose it?

Choosing the file is safer, because the hash covers its exact bytes, including line endings and a final newline that copying and pasting can change. If you paste, copy from the raw file the CDN serves, not from a formatted view in developer tools.

Does SRI replace a Content Security Policy?

No, they work together. CSP decides which origins may supply scripts, while SRI makes sure the file from that origin is the one you reviewed. Using both protects against a compromised CDN as well as injected scripts from elsewhere.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

Hash Generator

Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.

CSP Builder

Build a Content-Security-Policy header from per-directive source lists.

Security Headers Generator

Generate HTTP security headers for nginx, Apache, Netlify and Express.

Base64 Encoder / Decoder

Encode and decode Base64, standard or URL-safe.

.env File Checker

Lint a .env file for syntax errors, duplicates and weak secrets.