SRI Hash Generator
Generate SHA-256, SHA-384, and SHA-512 Subresource Integrity hashes for scripts and stylesheets. Get ready-to-use integrity attributes and full HTML tags.
New to this tool? Click here for instructions
How to Use the SRI Hash Generator
Use Text / Paste when you already have the exact JavaScript or CSS file content. Paste the file contents, not an HTML <script> or <link> tag, and the SHA-256, SHA-384, and SHA-512 integrity values update automatically.
Use File Upload for a local file you downloaded or built. The browser reads the file into memory with FileReader and hashes that byte-for-byte content. Use URL Check for a public CDN URL that allows cross-origin fetches; the browser downloads the file directly, then hashes the response bytes locally.
When to Use the Tool in Real Workflows
Subresource Integrity is useful when you load versioned scripts or stylesheets from a CDN and want the browser to block the resource if the fetched bytes differ from the expected hash. It is most useful for static, pinned assets such as a specific package version on jsDelivr, cdnjs, or an internal asset host.
After generating a hash, enter the resource URL in the Resource URL field so the generated <script> and stylesheet <link> examples contain the same URL you will use in production.
How It Works
Pasted text and dropped files are hashed locally with the Web Crypto API's crypto.subtle.digest(). Nothing is uploaded to a ThisDevTool server. URL Check is different: your browser fetches the URL you entered from the remote CDN, subject to that host's CORS policy, and then hashes the downloaded bytes locally.
Tips, Edge Cases, and Limitations
Hash the exact file bytes the browser will receive. Minified and unminified builds, redirects to different versions, build timestamps, injected banners, or CDN transformations will produce different hashes. If the resource changes after deployment, update the integrity value or the browser will block it.
Use crossorigin="anonymous" with cross-origin SRI resources. SHA-384 is a practical default because it is strong and keeps the integrity string shorter than SHA-512, while SHA-256 and SHA-512 remain available for compatibility with your policy.
Sources Checked
Reference behavior was checked against MDN documentation for Subresource Integrity, SubtleCrypto digest, and CORS.
Frequently Asked Questions
integrity attribute containing a cryptographic hash to your <script> or <link> tags. Before executing or applying the resource, the browser computes the hash of the downloaded file and compares it to the value in the integrity attribute. If they don't match, the browser blocks the resource.integrity="sha256-... sha384-...") and the browser will use the strongest supported algorithm.Quick reference
| Mode | Input | Important note |
|---|---|---|
| Text / Paste | Exact JS or CSS file content | Hashes the pasted bytes in the browser. |
| File Upload | Any local file | Reads the file locally; no upload is performed. |
| URL Check | CORS-enabled CDN URL | Your browser fetches the remote file before hashing it locally. |
| HTML tags | Selected hash plus resource URL | Adds integrity and crossorigin="anonymous". |
Example walk-through
Generate an integrity attribute for a static script
Step 1. Download or copy the exact contents of the JavaScript file you plan to load from a CDN.
Step 2. Paste the file content into Text / Paste mode. The output should start with sha256-, sha384-, and sha512-.
Step 3. Keep SHA-384 selected, then enter the public CDN URL in Resource URL.
Step 4. Copy the generated script tag and use it with the same versioned URL.
<script
src="https://cdn.example.com/app.min.js"
integrity="sha384-..."
crossorigin="anonymous"
></script>Step 5. If the CDN file changes, regenerate the hash before deploying the tag.