Make the integrity hash and script or link tag for a CDN file, or check one
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.An SRI hash is the Base64 SHA-256, SHA-384 or SHA-512 digest of a file, written as sha384-... in a script or link tag's integrity attribute. The browser hashes what it downloads and refuses to run it if the value differs. This page builds the value and the tag, and checks an existing one.
Open the .js or .css file, or paste its exact contents.
Enter the URL the page will load it from, so the tag is ready to paste.
Pick the algorithms; SHA-384 is the usual choice and is ticked already.
Copy the integrity value or the whole <script> or <link> tag.
Subresource Integrity lets a page load a script or stylesheet from a CDN and still be sure it is the file you tested. You put the file's hash in the integrity attribute; if the CDN is hacked or serves a different version, the browser blocks the file instead of running it.
How the value is made. The file's exact bytes are hashed with SHA-256, SHA-384 or SHA-512, the digest is written in Base64, and the algorithm name goes in front: sha384- followed by 64 characters. Open the file itself where you can: pasted text is hashed as UTF-8, and Windows line endings or a byte order mark change every character of the result, so the page warns when it sees either.
Which algorithm. SHA-384 is the common choice and what most CDNs publish. You may list several values separated by spaces. The browser then uses only the strongest algorithm present and accepts the file if any value of that algorithm matches, so a correct SHA-256 beside a wrong SHA-512 still blocks.
| In the attribute | What the browser does |
|---|---|
sha384-A sha512-B |
Checks the file against B only |
sha384-A sha384-B |
Accepts either of two versions |
md5-A or nothing valid |
Loads the file without any check |
The tag. A file from another origin must be loaded with crossorigin="anonymous", or the browser blocks it before comparing anything. The tag is written for a classic script, a module, a stylesheet or a preload, with the URL escaped.
Checking. Paste a tag or an integrity list and open the file: you see the algorithm the browser compares, the value it computes, which entry matched, and any entry it ignores. The checks follow the W3C algorithm step by step and were tested against 411 hashes from Python's hashlib and the specification's own example. Nothing you open leaves the browser.
An SRI hash is the Base64 digest of a file's exact bytes with SHA-256, SHA-384 or SHA-512, prefixed by the algorithm name, such as sha384- and 64 characters. Placed in the integrity attribute of a script or link tag, it makes the browser refuse the file if a single byte differs.
Download the exact file the CDN serves, open it here and enter its URL. The SHA-384 value and a ready script tag with crossorigin set to anonymous appear at once. Pasting the code also works, but line endings must match the served file exactly, or the hash will differ.
SHA-384 is the usual choice and what most CDNs publish; SHA-512 is equally safe and only longer. SHA-256 is still accepted. Browsers ignore MD5 and SHA-1 entirely. Listing several algorithms gains little, because the browser checks only the strongest one present in the attribute.
The file changed: a new version behind the same URL, a CDN that compresses or rewrites it, different line endings, or a byte order mark. Open the file the browser actually receives and check it here; the page shows the hash it computed beside the value you have, so you can replace it.
Yes, for any file on another origin. Without crossorigin the browser cannot read the response under CORS, so it blocks the file outright, even when the hash is right. Use anonymous unless the file needs cookies, and make sure the CDN sends an Access-Control-Allow-Origin header.
The browser keeps only the entries with the strongest algorithm and accepts the file if any one of them matches. A list with sha384 and sha512 is therefore judged by sha512 alone, while two sha384 values let one tag accept two versions of a file during an upgrade.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about SRI Hash Generator and anybody who knows can answer. No account needed.
Same job, other tools: Bcrypt Generator – Generate a bcrypt hash for a test user or a config file · HMAC-SHA256 Generator – Compute an HMAC-SHA256 signature in hex and Base64.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.