Subresource Integrity Hash Generator
Generate the integrity attribute for a script or stylesheet from its file or contents, with the full script or link tag including crossorigin.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a Subresource Integrity hash
Output
integrity attribute
integrity
…
<script> tag
<script src="https://cdn.example.com/app.js" integrity="…" crossorigin="anonymous"></script>
The browser hashes what the CDN sends and refuses to run it if one byte differs, so a compromised CDN cannot inject code. Hash the exact file served: a pasted copy with different line endings gives a different hash. crossorigin="anonymous" is required for cross-origin files, and the CDN must send CORS headers.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
What SRI protects against
With Subresource Integrity, the browser hashes a file from a CDN and refuses to run it unless the hash matches the integrity attribute. A compromised or tampered CDN then breaks the page rather than serving an attacker's script to every visitor.
Getting it right
Hash the exact bytes the CDN serves; a copy with different line endings has a different hash. Pin an exact version in the URL, because a URL that floats to the latest release breaks the moment it changes. Cross-origin files need crossorigin="anonymous" and a CDN that sends CORS headers, or the browser blocks them. From a terminal: openssl dgst -sha384 -binary app.js | openssl base64 -A.