◎ SEOlust
Security

SRI Hash Generator

Generate Subresource Integrity (SRI) hashes (SHA-256/384/512) for scripts and stylesheets. Paste content or upload a file.

All tools
Algorithm:

About the SRI Hash Generator

Generate Subresource Integrity (SRI) hashes for your scripts and stylesheets so browsers can verify third-party files have not been tampered with.

What this tool does

Paste a file's contents, upload the file, or fetch it from a URL, and the tool computes SHA-256, SHA-384, or SHA-512 integrity values plus a ready-to-use script tag. Everything is hashed locally in your browser using the Web Crypto API.

What is Subresource Integrity?

SRI lets you add an integrity attribute to a script or link tag. The browser hashes the downloaded file and refuses to run it if the hash does not match — protecting you if a CDN is compromised or a file is swapped.

  • Protects against tampered or hijacked CDN assets.
  • Required by many security policies for third-party scripts.
  • Works together with the crossorigin attribute.

How to use the output

Add the generated integrity value and crossorigin="anonymous" to your tag. If the file ever changes, regenerate the hash — even a one-byte change produces a completely different value, which is the point.

FAQ

Which hash should I use?
SHA-384 is the common recommendation and default. SHA-256 and SHA-512 are also valid; you can even include multiple.
Why did fetching from a URL fail?
The remote server may not send CORS headers that allow your browser to read the file. In that case, download the file and use the paste or upload option.
Is the file uploaded to your server?
No. Hashing happens entirely in your browser; file contents never leave your device.
Do I need the crossorigin attribute?
Yes, for cross-origin resources. Without crossorigin="anonymous", the browser will not enforce the integrity check on CDN files.

Related tools

Pro tip: pair this tool with Robots.txt Exposure Checker and Cookie Security Checker for a faster SEO workflow.