01
Choose the bytes you will ship
File mode preserves exact bytes, while text mode encodes what is in the editor as UTF-8. Even one trailing newline changes the value.
Web Security Config
SRI hash generatorHash the exact bytes before publishing
Choose pasted source or a local file; the optional URL is used only to assemble the tag.
SRI hash generator
Source content
Text is encoded as UTF-8; file mode preserves exact bytes.
SRI result
Content stays in this browser tab; the address is never fetched.
Options
One file up to 20 MiB or 1,000,000 text units. SHA-256/384/512 only.
Enter text or choose a file.
SRI hash generator is useful when a CDN script or stylesheet must stay pinned to the bytes you reviewed. A version label alone does not prove that the delivered file stayed identical.
A Subresource Integrity generator must encode the raw digest as Base64, not show the hex string from a general file checksum. Hash the final deployed file whenever possible; pasted text may have different line endings.
Why use this SRI hash generator?
See the bytes and the value that your markup will actually use.
Start from the final local file
SRI hash generator reads one selected file as raw bytes, including its BOM and line endings. It never fetches the address typed for the HTML tag, so an unreviewed CDN response cannot quietly become the reference.
Compare an existing token
Paste one SHA-256, SHA-384 or SHA-512 integrity value that uses the chosen algorithm. A mismatch is shown beside the newly calculated value; copying stays disabled as soon as any input changes.
Avoid the easy SRI mistakes
02
Choose one algorithm deliberately
SHA-384 is the default; the existing token field accepts only one token of that same algorithm. Changing it requires a new run.
03
Check the markup before copying
An address is optional and never fetched. Without it, copy the integrity attribute; with it, inspect the generated script or stylesheet tag and its crossorigin setting.
From source bytes to usable markup
Spec-format hashes
The integrity attribute generator produces sha256-, sha384- or sha512-prefixed Base64. The displayed SHA-384 SRI hash is not a hex file checksum.
Local byte comparison
Use the SRI hash verifier field to compare one existing token with the selected text or file. A well-formed but different token is a mismatch, not a parser error.
Script and stylesheet tags
Choose script or link rel="stylesheet"; the URL is escaped as an HTML attribute and crossorigin="anonymous" is included for cross-origin use.
Cancelable file calculation
A worker reads at most one 20 MiB file into Web Crypto. Cancel or change input to discard the pending result, and stale output cannot be copied or downloaded.
Exact-byte and deployment limits
- No remote verification
- The address field never makes a request. The tag only claims a hash of the selected local content; it cannot prove that a CDN currently serves those bytes or allows CORS.
- One token per comparison
- This page rejects mixed or multiple integrity tokens. Browsers treat mixed algorithms by prioritizing the strongest, so a naive any-token match would give the wrong conclusion.
- Final assets may differ
- A bundler, CDN rewrite, compression source or library update can change bytes after this run. Hash the final served file and update the attribute with each release.
- Finite browser input
- One file is limited to 20 MiB and pasted text to 1,000,000 UTF-16 units. No URL fetch, directory batch, MD5, SHA-1, malware scan or signature check is offered here.
SRI hash generator questions
Which hash algorithm should I use for SRI?
SRI hash generator defaults to SHA-384 and also supports SHA-256 and SHA-512, the three algorithms in the SRI specification. Choose the algorithm required by your build or CDN workflow.
Why is crossorigin needed on a cross-origin script?
For a cross-origin resource, the browser needs a CORS-enabled request and a server response that permits it. The generated tag includes crossorigin="anonymous"; this tool does not test the server headers.
Can SRI protect a resource that changes on every request?
Usually no. A different response has different bytes, so a fixed SRI value can block the updated file. Pin a stable asset version and recalculate after a deliberate release.
Does pasted content or a selected file leave the browser?
No. The pasted text or selected file is hashed in this browser tab. The optional resource URL is only written into output markup and is never fetched by this tool.
Why does a deployed SRI hash no longer match the file?
Check the final file, line endings, build output and CDN version. SRI compares exact bytes; even a newline or updated bundle can make the previously published token fail.
Still have a question?
Use the SRI hash generator on your next asset
Return to the SRI hash generator with the exact file you plan to serve, then review its integrity value and complete tag before publishing.