ES
Home › Developer Tools › SRI Hash Generator

SRI Hash Generator

Generate Subresource Integrity hashes for your JavaScript and CSS files. Paste the code, drop in files or fetch a CDN URL, choose sha256, sha384 or sha512, and copy a complete <script> or <link> tag with the integrity and crossorigin attributes. You can also verify an existing integrity value.

Last updated:

Algorithms

Verify an integrity value

Advertisement
Advertisement

How to use the SRI Hash Generator

  1. Choose the input: paste the file's code, upload files, or enter the CDN URL of the script or stylesheet.
  2. Pick the hash algorithm. sha384 is the common default; you can add several.
  3. Click Generate SRI Hash to compute the integrity value.
  4. Copy the tag or just the integrity value and paste it into your HTML.
  5. Verify later: paste an existing integrity value in the Verify box to confirm a file still matches.

How to add SRI to a script or stylesheet

Add two attributes to the tag: integrity with one or more hashes, and crossorigin so the browser fetches the file with CORS and is allowed to check it.

<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/library.min.js"
        integrity="sha384-..." crossorigin="anonymous"></script>

<link rel="stylesheet" href="https://cdn.example.com/[email protected]/main.css"
      integrity="sha384-..." crossorigin="anonymous">

When the downloaded file's digest does not match, the browser blocks it and logs an error such as "Failed to find a valid digest in the 'integrity' attribute" in the console.

Integrity value format

AlgorithmDigest sizeBase64 lengthExample prefix
SHA-256256 bits (32 bytes)44 characterssha256-
SHA-384384 bits (48 bytes)64 characterssha384-
SHA-512512 bits (64 bytes)88 characterssha512-

The digest is encoded in standard Base64 (with +, / and = padding), not hex. Several values are separated by spaces. The same tool from the command line: openssl dgst -sha384 -binary file.js | openssl base64 -A.

SRI tips

  • Use SRI only for immutable, versioned files. Pin the exact version in the URL (@3.10.1), never "latest".
  • Regenerate the hash every time you update the file. A build step can do it automatically.
  • Combine SRI with a Content Security Policy: CSP limits where scripts may come from, SRI guarantees what they contain.
  • Keep a fallback in mind: if a CDN changes a file, SRI blocks it, so test pages after any dependency upgrade.

Frequently asked questions

What is Subresource Integrity (SRI)?

Subresource Integrity is a W3C standard that lets a browser check that a script or stylesheet it downloads has not been changed. You add integrity="sha384-..." to the script or link tag; if the downloaded file's hash does not match, the browser refuses to run or apply it. It protects your site if a CDN or third-party host is compromised.

Which hash algorithm should I use?

Browsers support sha256, sha384 and sha512. sha384 is the most common choice and is what most CDNs publish. If you list several hashes, the browser uses the strongest algorithm present and the file must match one of the hashes for that algorithm.

Why do I need crossorigin="anonymous"?

For files loaded from another origin, the browser can only check integrity when the response is fetched with CORS. crossorigin="anonymous" requests the file without cookies, and the server must reply with an Access-Control-Allow-Origin header. Without it, a cross-origin resource with an integrity attribute is blocked.

Why does my hash not match the CDN's hash?

SRI hashes the exact bytes of the file. A single changed byte, a different line ending (CRLF vs LF), a missing final newline, or a minified versus unminified build gives a completely different hash. Pasted text uses LF line endings, so for an exact match upload the file or fetch it by URL.

Can I use SRI with files that change, like Google Fonts CSS or analytics scripts?

No. SRI only works for files whose content never changes, such as versioned library files ([email protected]). Resources that vary by browser or are updated in place, like Google Fonts CSS or tag manager scripts, will fail the check and be blocked.

How is the integrity value calculated?

The browser computes the SHA digest of the raw file bytes, encodes the binary digest in standard Base64 (not hex), and prefixes it with the algorithm name and a hyphen, for example the one-line script alert('Hello, world.'); has the integrity value sha384-H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO.

Are all the tools on FreeToolCabin tested for quality and accuracy?

Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.

Related tools

Content Security Policy GeneratorBuild a CSP header or meta tag with nonces, hashes, presets and report-only mode.File Hash CheckerGet MD5, SHA-1, SHA-256 and SHA-512 checksums of files and verify them against a hash.SHA-256 Hash GeneratorSHA-256 and HMAC-SHA256 hashes of text, lines or files, in hex or Base64.Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files.Password GeneratorCreate strong passwords and passphrases.MD5 Hash GeneratorGenerate MD5 hashes of text, lines or files and verify checksums.Base64 Encoder DecoderEncode or decode Base64 text and files, and make data URIs.URL Encoder DecoderPercent-encode or decode URLs, query strings and form data.HTML Entity Encoder / DecoderEscape and unescape HTML entities, named or numeric.Bcrypt Hash Generator & CheckerCreate bcrypt password hashes and check a password against a hash.Binary TranslatorConvert text to binary, hex, octal and back.HMAC GeneratorGenerate and verify HMAC signatures with SHA-256, SHA-512, SHA-1 or MD5.CRC32 Checksum CalculatorCalculate CRC-32, CRC-32C, CRC-16 and Adler-32 checksums of text or large files.JWT DecoderDecode JSON Web Tokens, read the claims and expiry, and verify HS256 signatures.JWT GeneratorCreate and sign HS256, HS384 or HS512 JSON Web Tokens in your browser and verify them.Password Strength CheckerSee how strong a password really is, how long it takes to crack and how to improve it.Caesar CipherEncode and decode Caesar shift ciphers and crack unknown shifts with a ranked brute force.Vigenère CipherEncrypt and decrypt Vigenère and Autokey ciphers, and crack unknown keys with frequency analysis.Atbash CipherEncode and decode Atbash ciphers (A↔Z, B↔Y) in Latin or Hebrew, with a live letter mapping table.ASCII TableFull ASCII code chart 0–255 in decimal, hex, octal, binary and HTML, with search and copy.Unicode Character LookupFind Unicode characters by name or code point and copy them with UTF-8, HTML and code escapes.Punycode ConverterConvert international domain names, emails and URLs between Unicode and xn-- Punycode, in bulk.JSON Escape / UnescapeEscape text for a JSON string, unescape \n and \" back to text, or stringify a whole object.Binary to HexConvert binary to hex instantly with steps and signed mode.Hex to BinaryConvert hex to binary instantly with steps and signed mode.Binary CalculatorAdd, subtract, multiply, divide, AND, OR, XOR and shift binary numbers with decimal values.Hex CalculatorHexadecimal + − × ÷ and AND, OR, XOR, NOT, shifts with decimal and binary equivalents.Base32 Encoder / DecoderEncode and decode Base32 (RFC 4648), Base32hex, Crockford and z-base-32 from text, hex or files.Base58 Encoder / DecoderEncode and decode Base58 and Base58Check (Bitcoin alphabet) from text or hex, with checksum verification.Unicode Escape / UnescapeConvert text to \uXXXX, \u{...}, \x, &#...; or CSS escapes and decode them back.TOTP GeneratorGenerate 2FA one-time codes from a secret key, create otpauth QR codes and verify codes.RSA Key GeneratorGenerate 2048, 3072 or 4096-bit RSA key pairs as PEM, PKCS#1, JWK or OpenSSH, locally.SSL Certificate DecoderDecode PEM SSL/X.509 certificates: subject, issuer, expiry, SANs, key and fingerprints.Text Encryption ToolEncrypt and decrypt text with a password using AES-256-GCM, entirely in your browser.Argon2 Hash GeneratorHash passwords with Argon2id, Argon2i or Argon2d and verify them against an encoded hash.Base64 to PDFDecode a Base64 string to a PDF with preview and download, or encode a PDF to Base64.Bitwise CalculatorCalculate AND, OR, XOR, NOT and bit shifts at 8–64 bits with a bit grid and all bases.CSR GeneratorCreate a certificate signing request (CSR) and private key with SANs, RSA or ECDSA, in your browser.SHA-512 Hash GeneratorSHA-512 and SHA-384 hashes of text or files in hex or Base64, HMAC and hash verification.SSH Key GeneratorGenerate Ed25519 or RSA SSH key pairs in your browser: OpenSSH public key plus private key.String Escape / UnescapeEscape or unescape strings for JavaScript, Java, C#, Python, C, SQL, regex, CSV and shell.UTF-8 Encoder / DecoderConvert text to UTF-8 bytes in hex, decimal, binary, \x or % and decode bytes back to text.UUID Decoder & ValidatorDecode any UUID: version, variant, v1/v6/v7 timestamp and MAC node, plus bulk validation.Base64 to FileDecode Base64 or a data URI to a downloadable file; detects the real file type and previews it.File Encryption ToolEncrypt and decrypt any file with a password using AES-256-GCM, entirely in your browser.Passphrase GeneratorMake strong, memorable diceware passphrases from a 7,776-word list, with entropy in bits.CSR DecoderDecode a PEM certificate signing request: subject, SANs, key size, signature and CA readiness checks.Enigma Machine SimulatorEncrypt and decrypt with a virtual Enigma I, M3 or M4: rotors, rings, plugboard and lampboard.Hex Opacity CalculatorConvert opacity percent to a 2-digit HEX alpha code and full #RRGGBBAA color, with a 0-100% table.Playfair CipherEncrypt and decrypt Playfair ciphers from a keyword, with the 5x5 key square and every digraph step.Pwned Password CheckerCheck if a password appeared in data breaches; only 5 characters of its SHA-1 hash are sent.RSA Encryption ToolEncrypt text with an RSA public key and decrypt it with the private key using RSA-OAEP in your browser.SAML DecoderDecode SAMLRequest and SAMLResponse messages to readable XML, attributes and validity times.SSL Certificate ConverterConvert SSL certificates and keys between PEM, DER, PFX/P12 and P7B in your browser.Checksum CalculatorCompute 8-bit sum, two's complement LRC, XOR/BCC, NMEA, Fletcher and Internet checksums of bytes.PBKDF2 Hash GeneratorDerive PBKDF2 keys from a password, salt and iteration count with SHA-1, SHA-256 or SHA-512.Protobuf DecoderDecode raw Protocol Buffers hex or Base64 without a schema, or add a .proto for field names.XML Escape / UnescapeEscape & < > " ' for XML text and attributes, unescape entities back, or wrap text in CDATA.Binary Search Tree VisualizerInsert, delete and find in BST, AVL and red-black trees with animated rotations and traversals.MongoDB ObjectId to TimestampDecode a MongoDB ObjectId to its creation date, or build ObjectIds from dates for range queries.PGP Encrypt / DecryptEncrypt, decrypt, sign and verify PGP messages with your armored keys, entirely offline.PGP Key GeneratorGenerate an OpenPGP key pair (Curve25519, NIST ECC or RSA) with passphrase and expiry, offline.Quoted-Printable Encoder / DecoderEncode or decode quoted-printable email text (MIME) with UTF-8 and 76-character soft line breaks.Self-Signed Certificate GeneratorCreate a self-signed SSL certificate and key for localhost or dev servers, as PEM or PFX.SHA-1 Hash GeneratorSHA-1 and HMAC-SHA1 of text or files in hex or Base64, plus Git blob hashes and verify.
See all 65 Encoders, Hashes & Crypto →