Free SRI Hash Generator

The SRI Hash Generator is a free online tool that creates Subresource Integrity hashes for external scripts and stylesheets to protect against CDN compromise.

Yes, it is completely free with no registration required. All hash generation happens client-side in your browser.

SRI hashes ensure that external scripts loaded from CDNs have not been tampered with. If the file changes, the browser will block it from executing.

Absolutely. The SRI Hash Generator processes everything client-side in your browser. No data is uploaded to or stored on any server. Your content remains private on your device at all times.

Yes, the SRI Hash Generator is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the SRI Hash Generator in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The SRI Hash Generator works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

All three are SHA-2 hash functions and all are valid for Subresource Integrity; the difference is digest length and the strength margin it gives you. SHA-256 produces a 256-bit hash, SHA-384 a 384-bit one, and SHA-512 a 512-bit one, so the integrity attribute gets progressively longer. The W3C specification names SHA-384 as the recommended default because it balances a strong security margin against attribute length, which is why this tool selects it by default. You are not locked in, though: you can even list several hashes in one attribute, like integrity="sha384-... sha512-...", and the browser will use the strongest algorithm it understands. Generate your file here and the tool returns all three digests at once, with the one matching your selected algorithm marked as primary so you can copy whichever you prefer.

Subresource Integrity can only verify a file the browser is allowed to read, and for a resource loaded from a different origin than your page, that permission comes from CORS. Adding crossorigin="anonymous" makes the browser send an anonymous cross-origin request, and as long as the host returns the right CORS headers the response becomes readable so its hash can be computed and compared. Leave the attribute off and the browser treats the cross-origin response as opaque: it cannot read the bytes, cannot verify the integrity hash, and refuses to load the resource, so your script or stylesheet silently fails. That is why every script and link tag this tool generates already includes crossorigin="anonymous". Paste your file or URL, copy the finished tag, and the CORS attribute is handled for you.

When you attach an integrity attribute, the browser downloads the resource, hashes the bytes with the named algorithm, and compares the result to the value you supplied. If they match, the file runs normally. If they differ for any reason, the file was modified, replaced, or the CDN was compromised, the browser refuses to use it entirely: a blocked script never executes and a blocked stylesheet never applies, and a network error is reported in the console. This hard failure is the whole point, turning a silent supply-chain compromise into a visible, enforced block rather than letting tampered code run. Because a blocked resource can break a page, this tool can also emit an onerror fallback that swaps in a local copy, so the page degrades gracefully. Generate a hash above and add it to your tag to enable this protection.

An SRI hash verifies one exact snapshot of a file, so any legitimate change breaks it on purpose. If a library ships a new version, the CDN serves a patched build, or you bump a pinned URL, the bytes differ and the old hash will no longer match, causing the browser to block the resource until you regenerate. The fix is to compute a fresh hash for the new file and replace the value in your integrity attribute. To avoid surprise breakage, pin to a versioned, immutable URL rather than a floating latest path, so the file only changes when you deliberately point at a new version. When that happens, paste the updated file or its URL into this tool, generate the new hash, and copy the replacement tag straight into your HTML.

Pasting content or uploading a file is hashed entirely in your browser, so nothing leaves your machine. Batch mode is different: to hash a remote asset it first has to download that file, and that fetch is a real cross-origin request subject to the host's CORS policy. If the CDN or server does not return permissive CORS headers, the browser blocks the response your code cannot read, and the fetch fails even though the file exists and the URL is correct. Some hosts also rate-limit or refuse automated requests. This is a limitation of the remote server, not the hash itself, since the same file pasted in hashes fine. For guaranteed results, download the file and use the paste or upload tab instead. Try the batch presets here for popular libraries, and fall back to paste mode when a URL is blocked.