🔏SRI Hash Generator

About this tool

Open the exact JavaScript or CSS file you'll load from a CDN (or paste its contents), choose the algorithm and tag type, and add the URL. You get the integrity value and a complete <script> or <link> tag to paste into your HTML.

How Subresource Integrity works

When a page loads a script from a CDN, the browser normally trusts whatever the CDN sends. If the CDN is compromised, attackers can inject code into every site using it. Subresource Integrity fixes this. You publish a cryptographic hash of the file you expect, such as integrity="sha384-…", and the browser hashes what it downloads and refuses to run it if the hashes differ. SRI needs crossorigin="anonymous" for cross-origin files so the browser can read the bytes. SHA-384 is the common choice. You can list several hashes separated by spaces, and the strongest one the browser supports is used. This tool hashes the file with the Web Crypto API and base64-encodes the digest. We checked it against openssl dgst -sha384 -binary FILE | openssl base64 -A and the results match. Honest limits: the hash must match the served file byte for byte, so open the downloaded file rather than pasting, because pasting can change line endings or encoding. Pin an exact version, since the hash breaks whenever the file changes. URLs aren't fetched, so no requests leave your browser. The hash generator, the CSP header generator and the HMAC generator are related.

Frequently asked questions