SRI hash generator

What Subresource Integrity is for

When a page loads a script or stylesheet from a third party - a CDN, most often - it is trusting that third party not to serve something different or malicious later. An integrity attribute lets the browser check the file it actually received against a hash you specify; if a CDN is compromised and starts serving altered content, the hash no longer matches and the browser refuses to run it.

How to use the output

Paste the exact contents of the file as it will be served - byte for byte, since even whitespace differences change the hash - and add the resulting string to the tag:

<script src="..." integrity="sha384-..." crossorigin="anonymous"></script>

The crossorigin attribute is required alongside integrity for a cross-origin resource, or the browser will not apply the check at all.

Which algorithm to pick

SHA-384 is the most common default in practice; SHA-256 is faster to compute and still entirely adequate; SHA-512 costs more bytes for no practical benefit over 384 at these lengths. Multiple hashes can be given space-separated in one integrity attribute - the browser accepts the resource if any one matches.

Nothing leaves your browser

Hashing runs entirely client-side via the Web Crypto API. Pasted content is never sent to this server.

Related tools

Already have a hash and want to check it against a live URL instead of pasted content? See the SRI checker.