Check whether a file still matches its integrity attribute before the browser blocks it
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.A browser blocks a script whose bytes no longer match its integrity attribute, and the page breaks with only a console error. Paste the tag or the integrity value and open the file: the check follows the W3C algorithm, so with sha384 and sha512 both listed only the sha512 counts, and an unknown algorithm is skipped. You see the hash the browser computed and which value matched.
Paste or type your input.
Choose the options you need.
Press Ctrl+Enter, then copy or download.
Subresource Integrity lets a page load a script or stylesheet from a CDN and still be sure it is the file you tested. You put the file's hash in the integrity attribute; if the CDN is hacked or serves a different version, the browser blocks the file instead of running it.
Which algorithm. SHA-384 is the common choice and what most CDNs publish. You may list several values separated by spaces. The browser then uses only the strongest algorithm present and accepts the file if any value of that algorithm matches, so a correct SHA-256 beside a wrong SHA-512 still blocks.
| In the attribute | What the browser does |
|---|---|
sha384-A sha512-B |
Checks the file against B only |
sha384-A sha384-B |
Accepts either of two versions |
md5-A or nothing valid |
Loads the file without any check |
The rest of the article, and all 6 questions about SRI Hash Generator, are on the SRI Hash Generator page.
An SRI hash is the Base64 digest of a file's exact bytes with SHA-256, SHA-384 or SHA-512, prefixed by the algorithm name, such as sha384- and 64 characters. Placed in the integrity attribute of a script or link tag, it makes the browser refuse the file if a single byte differs.
The file changed: a new version behind the same URL, a CDN that compresses or rewrites it, different line endings, or a byte order mark. Open the file the browser actually receives and check it here; the page shows the hash it computed beside the value you have, so you can replace it.
Yes, for any file on another origin. Without crossorigin the browser cannot read the response under CORS, so it blocks the file outright, even when the hash is right. Use anonymous unless the file needs cookies, and make sure the CDN sends an Access-Control-Allow-Origin header.
The browser keeps only the entries with the strongest algorithm and accepts the file if any one of them matches. A list with sha384 and sha512 is therefore judged by sha512 alone, while two sha384 values let one tag accept two versions of a file during an upgrade.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about SRI Hash Generator and anybody who knows can answer. No account needed.
Same job, other tools: Webhook Signature Verifier – Check that a webhook body matches the signature header its sender attached · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.