Loading a script from a third-party CDN means trusting that CDN not to serve you something different tomorrow — whether from a hack, a supply-chain compromise, or a silent file swap. Subresource Integrity (SRI) closes that gap: the browser refuses to execute the file if its hash doesn’t match what you specified.
What Is the SRI Generator?
SRI Generator is one of the tools in WebdevToolbox’s Security & Crypto category. Paste the exact contents of a JS or CSS file (or fetch a URL directly, CORS permitting) and get sha256/sha384/sha512 integrity hashes plus a ready-to-paste <script> or <link> tag.
How to Use It
- Open the tool at /tools/sri-generator.
- Paste the file’s exact content, or enter a CDN URL and click “Fetch & hash.”
- Copy the sha384 hash (the common default) or use the ready-made tag at the bottom.
- Add
crossorigin="anonymous"alongsideintegrity— both are required together.
Key Features
- Three hash algorithms at once — sha256, sha384, and sha512, all computed via the browser’s native Web Crypto API.
- Ready-to-use tag generator — copy a complete
<script>or<link>snippet, not just a raw hash. - Optional URL fetch — pulls a resource directly when the CDN’s CORS policy allows it.
- 100% private — hashing happens in your browser; nothing is uploaded anywhere.
When to Use SRI Generator
- Adding a CDN script/stylesheet to production — lock it to the exact bytes you reviewed.
- Security audits — verify a page’s existing
integrityattributes actually match the hosted file. - Compliance requirements — some security policies mandate SRI on all externally hosted resources.
Try It Now
Open SRI Generator directly from anywhere on the site using ⌘K and typing the tool name.
Part of the Security & Crypto collection on WebdevToolbox — free, browser-based developer tools with no login required.