SRI checker

What this checks

Fetches the URL you give it and computes its SHA-256/384/512 hash, comparing it against an integrity value you supply if you have one - the same comparison a browser makes before running a script or applying a stylesheet that carries that attribute. Leave the integrity field blank to just see what the resource currently hashes to.

Why the fetch happens on our server, and what that means

The resource is retrieved server-side, through the same SSRF-protected fetcher every URL-based tool here uses - it cannot be pointed at an internal address, and every redirect hop is re-checked. This also means the fetch is not subject to CORS the way a browser's own request would be.

The gap that matters: a match here is not a guarantee in the browser

A browser applying SRI to a cross-origin resource additionally requires that resource to be served with a permissive Access-Control-Allow-Origin header, or it refuses to apply the integrity check at all and blocks the resource outright - regardless of whether the hash would have matched. A hash matching here confirms the content itself is what you expect; it does not confirm a browser will actually be willing to load it under SRI.

Related tools

To generate a hash from content you already have rather than a live URL, see the SRI hash generator.