SRI Hash Generator (Subresource Integrity)

Subresource Integrity (SRI) protects you when a script or stylesheet is served by a CDN: the integrity attribute holds a hash of the file, and the browser refuses to run anything that does not match — so a compromised CDN cannot inject code into your pages. This generator hashes your .js and .css files with SHA-256, SHA-384 or SHA-512 and writes the complete <script> and <link> tags. Files are read in your browser and never uploaded.

How to use this tool

1. Choose the exact script and stylesheet files you serve (several at once is fine).
2. Keep sha384 ticked, or add sha256 / sha512.
3. Optionally enter the CDN URL prefix so the tags point to the right place.
4. Copy the tags into your HTML, and regenerate them whenever a file changes.

Formula

integrity = "sha384-" + Base64( SHA-384( file bytes ) )

Several hashes can be listed separated by spaces; the browser uses the strongest one it supports. The hash covers the decoded file content exactly as the server delivers it. Cross-origin files also need crossorigin="anonymous" and a CORS header from the CDN.

Example

A file containing the two lines "Hello world." and "Second line." hashes to sha384-qz16ceSTbRFP2Cq/fJtcq1vCKSYtXMQHaignNteTVrwHtD0BoRRivONxZz8RNNUY — the same value as openssl dgst -sha384 -binary file | base64. For app.js with the prefix https://cdn.example.com/ the tag is <script src="https://cdn.example.com/app.js" integrity="sha384-…" crossorigin="anonymous"></script>.