SRI Hash Generator
Generate SRI values from UTF-8 resource text
Paste JS or CSS content first and click Generate SRI hashes; deployment and verification notes are available in Advanced mode.
The full guide also includes pitfalls, worked examples, snippets, FAQs, and related tools for checking results or troubleshooting.
About this tool
Paste resource text and click Generate to obtain algorithm-prefixed Base64 digests with Web Crypto. This tool hashes the UTF-8 text in the textarea, including empty text; it does not fetch a URL or read a file. For deployment, the hashed bytes must equal the resource bytes checked by the browser. Pasting can alter line endings or omit a BOM, so use the original build artifact and a byte-preserving method when those details matter. SRI is used with supported fetched resources such as external scripts and stylesheets; ordinary inline scripts do not gain SRI checks from an integrity attribute.
Production Snippets
A reproducible digest requires exact bytes
text
Input UTF-8 text: abc (no trailing newline)
SHA-256 SRI:
sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0=
Adding a newline changes the value.
A URL pasted here is text, not a fetched resource.Frequently Asked Questions
Which algorithms are generated?
SHA-256, SHA-384 and SHA-512, each formatted as an algorithm prefix followed by a Base64 digest. SHA-384 is a common choice; match your deployment requirements.
Can I paste a CDN URL?
A URL is hashed as literal text; it is not downloaded. This textarea cannot certify that pasted text equals the CDN response bytes.
What else is needed for a cross-origin resource?
The resource must be CORS-eligible for SRI. Configure the server’s CORS response and the element’s crossorigin setting, then test the actual request in a browser.
Does generating SRI configure CSP?
No. SRI and CSP are separate browser checks. A CSP hash source uses its own quoted policy syntax and must match the directive and content being authorized.
Why does a tiny edit break integrity?
Any changed byte changes the digest. Regenerate after minification, whitespace or newline changes, and publish the resource and matching integrity value together.
Keep browsing