Tool #157 · Web Security

SRI Hash Generator & Integrity Checker

Generate sha256, sha384, and sha512 Subresource Integrity strings from pasted code or uploaded files, verify existing integrity values, and copy ready-to-ship HTML tags without leaving your browser.

Client-side only No content upload. Hashes are computed locally with Web Crypto.

Tag generator Build script and stylesheet tags with crossorigin included.

Verification mode Check whether an existing integrity string still matches the asset.

Generate integrity values

Paste asset contents directly or upload a local file. If both are present, the uploaded file wins.

Asset URL used for tag generation only

HTML tag type

crossorigin

Algorithms

sha256 sha384 sha512

Asset contents

Upload file JS, CSS, or any static asset

SRI hashes are based on exact bytes. Any whitespace, minification, or rebuild changes the result.

Results

Copy a single hash, a combined integrity attribute, or a full HTML tag.

Integrity attribute value

Generate a hash to see integrity output here.

HTML tag

A ready-to-use script or link tag will appear here.

Single digest breakdown

Each selected algorithm will appear on its own line here.

Verify an existing integrity string

Paste the current asset contents and the integrity value you want to validate.

Integrity string

No verification run yet.

Verification details will appear here.

Implementation notes

Useful guardrails when shipping SRI in production.

Best default: use sha384 for CDN-hosted JS/CSS unless you have a policy requiring a different algorithm.

Don’t hash a moving target: any upstream file change invalidates the digest, so pin versions or self-host assets.

Remember CORS: cross-origin SRI usually expects crossorigin="anonymous" and a response that can be fetched in CORS mode.

Mismatch means block: if the downloaded bytes don’t match the integrity value, the browser refuses to execute or apply the asset.

Where this helps

Locking third-party CDN assets to a known-safe version.
Generating tags for deployment docs, README snippets, or static templates.
Checking whether a new build accidentally changed a published JS or CSS file.
Auditing old integrity values before a release or infrastructure migration.