Subresource Integrity Hash Generator

What is Subresource Integrity?

Subresource Integrity, usually abbreviated SRI, lets a browser verify that a fetched script or stylesheet matches a cryptographic digest chosen by the page author. If the downloaded bytes do not match the integrity attribute, the browser refuses to use the resource.

SRI is especially useful for versioned assets loaded from a third-party CDN. HTTPS protects the connection, while SRI checks that the final resource content is exactly what the page expected.

Generate an integrity attribute

Select the final local file or paste its exact content, choose SHA-256, SHA-384, or SHA-512, and generate the digest. SHA-384 is a common default. The result has this structure:

sha384-base64EncodedDigest

Add it to a script or stylesheet along with an appropriate crossorigin attribute:

<script
  src="https://cdn.example.com/library.min.js"
  integrity="sha384-..."
  crossorigin="anonymous"></script>

Hash the deployed bytes

The digest must match the exact representation returned by the public URL. A minifier, build step, CDN transformation, or automatic banner can change the bytes and invalidate a hash calculated from an earlier source file. Generate the SRI value from the final artifact and verify it again after deployment.

Normal HTTP content encoding such as gzip is decoded by the browser before integrity verification, but transformations to the underlying resource content still matter.

Multiple algorithms

An integrity attribute may contain multiple space-separated digests. Browsers choose the strongest recognized algorithm present and require a matching digest for that algorithm. Do not assume that including one correct weak digest will override an incorrect stronger digest.

CORS and external URLs

Cross-origin SRI requires the resource server to permit the request through CORS. This tool deliberately hashes pasted text or local files instead of fetching arbitrary URLs, because browser CORS rules often block such requests and a failed fetch can be mistaken for an integrity failure.

Privacy and security limits

Hashing occurs with the browser Web Crypto API. Files and pasted source are not uploaded to MiniUtil. SRI does not replace Content Security Policy, secure dependency management, HTTPS, or review of the code being loaded. It only verifies that the fetched resource matches the selected digest.

Read MDN's Subresource Integrity guide for browser behavior and deployment requirements. Use the Hash Generator for ordinary text digests or the Cache-Control Builder for caching headers.