SRI integrity
integrity = algorithm + '-' + Base64(HASH(resource bytes))
SRI Hash Generator
Compute the Subresource Integrity value in SHA-256, SHA-384 or SHA-512 from pasted content, a local file or a CDN URL, then copy the ready-to-use <script> or <link> tag with crossorigin="anonymous".
- Clipboard
Resource
Downloaded by your browser: the CDN must allow CORS (jsDelivr, cdnjs and unpkg do).
Integrity
Was this tool useful?
How does this tool work?
This generator computes the Subresource Integrity (SRI) value of a script or stylesheet and produces the matching HTML tag. It is for developers who load libraries from a CDN and want the browser to block any file that has been modified.
Subresource Integrity (a W3C specification) lets you add an integrity attribute holding the resource's expected hash to a <script> or <link rel="stylesheet"> tag. The value is the algorithm name, a hyphen and the binary hash encoded in Base64: a file containing exactly console.log("hello"); gives sha384-ym/3cF/gAcW1/eerNQGFaOSOuU2LHI6RYvChaVur/G+PkVozZ5Zo8Uu5R2S2zm7C. When loading, the browser recomputes the hash of the bytes it received and refuses to run the script or apply the stylesheet if it does not match. Only SHA-256, SHA-384 and SHA-512 are allowed; SHA-384 is the default, as in the specification's and MDN's examples.
For a cross-origin resource, the browser must be able to read the response to hash it, which requires a CORS request: the crossorigin="anonymous" attribute on the page and an Access-Control-Allow-Origin header from the CDN. The tool therefore adds crossorigin="anonymous" to the attributes and the generated tag. In URL mode, your browser downloads the file directly, with no intermediate server; this works with CDNs that allow CORS such as jsDelivr, cdnjs or unpkg. The equivalent command-line computation is openssl dgst -sha384 -binary file.js | openssl base64 -A.
How to use this tool
Choose the source
Paste the file's content, select a local file or enter a CDN URL: in that case your browser downloads the file directly.
Set the algorithm and type
Keep the default SHA-384 or choose SHA-256 or SHA-512, then specify whether it is a script or a stylesheet.
Copy the result
Take the integrity value on its own, the integrity and crossorigin="anonymous" attributes, or the complete <script> or <link rel="stylesheet"> tag.
SRI integrity
Use cases
Secure a library loaded from jsDelivr
Enter the versioned URL, for example https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css, to get the <link> tag with integrity. If the CDN is compromised and serves a different file, the browser blocks it.
Update the hash after a version upgrade
Every new version of a file changes its hash. Recompute the integrity attribute as soon as you change the versioned URL, otherwise the resource will be blocked in production.
Meet a PCI DSS requirement on payment pages
PCI DSS 4.0 (requirement 6.4.3) requires ensuring the integrity of every script loaded on a payment page. SRI is one of the common ways to do this for third-party scripts with stable content: generate the integrity value for each one.
Examples
SHA-256 integrity of text abc
Input
Resource: Pasted content; Resource content: abc; Algorithm: SHA-256Result
Integrity value: sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0=Tips and best practices
- Always use a URL pinned to an exact version: a "latest" or unversioned URL changes content and breaks the hash at the next release.
- Do not use SRI for dynamically generated resources, such as the Google Fonts stylesheet, whose content varies by browser: the hash would change from one visitor to the next.
- Hash exactly the file that is served: a minified, recompressed version or one with different line endings does not have the same hash as the source file.
Sources and references
- W3C, Subresource Integrity (opens in a new tab)Page in English
- NIST, FIPS 180-4 — Secure Hash Standard (SHS) (opens in a new tab)Page in English
Frequently asked questions
What is Subresource Integrity (SRI)?
It is a browser security feature, standardised by the W3C, that checks that a file loaded from a third party has not been modified. You put the expected hash in the integrity attribute; if the received file does not match, it is neither run nor applied. This protects against a compromised CDN or a file altered in transit.
Should I choose SHA-256, SHA-384 or SHA-512?
All three are accepted and secure. SHA-384 is the most common choice and the tool's default; SHA-512 works too and SHA-256 remains valid. You can list several values separated by a space in integrity: the browser then uses the strongest algorithm.
Why is crossorigin="anonymous" required?
For a cross-origin resource, the browser can only read its content, and therefore check its hash, through a CORS request. Without the crossorigin attribute the response is opaque and the resource is blocked. The anonymous value means no cookies or credentials are sent with the request.
What happens if the hash does not match?
The browser rejects the resource and logs an error such as "Failed to find a valid digest in the 'integrity' attribute" in the console. The script does not run or the stylesheet is not applied, which can break the page. Check that the URL is versioned and regenerate the hash from the file that is actually served.
Why does loading from a URL fail?
Your browser downloads the file and applies CORS rules: if the server does not send an Access-Control-Allow-Origin header, reading is refused. In that case SRI would not work either for this file loaded from another domain. Download it and use file mode, or choose a CORS-enabled CDN such as jsDelivr, cdnjs or unpkg.
Does SRI replace a Content Security Policy?
No, the two complement each other. SRI guarantees that a specific file has not changed, while a CSP restricts which origins may serve scripts and blocks injected scripts. For a site that relies on CDNs, combine a strict CSP with SRI on every third-party resource.
Related tools
Keep going with these tools
Tools similar or complementary to this one.
Similar tools
Build a Content Security Policy directive by directive, with HTTP header, meta tag and warnings.
Security & privacyUse this tool
Generate HSTS, nosniff, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and X-Frame-Options for Nginx or Apache.
Security & privacyUse this tool
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of a text or file in one go.
Security & privacyFeaturedUse this tool
Read next
GuideBest practicesBeginner
Subresource Integrity (SRI): verify external resource integrity
Understand how SRI hashes help detect unexpected changes to static third-party scripts and stylesheets, and where SRI does not apply.
29 August 20261 min
GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 min
GuideBest practicesBeginner
Hashes, integrity and fingerprint comparison: what a hash can really prove
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
29 August 20262 min
GuideBest practicesIntermediate
OAuth 2.0, PKCE, JWT, JWK and JWKS: understand their roles
Understand how OAuth 2.0, PKCE, JWT, JWK and JWKS fit together: authorization, tokens, public keys and verification.
23 September 20262 min