SRI Generator
NewGenerate Subresource Integrity (SRI) hashes for CDN-hosted JS/CSS files.
Subresource Integrity generator
Generate SRI hashes for CDN resources
Paste the exact file content (JS/CSS) to hash it locally, or fetch a URL directly (subject to CORS). Nothing is uploaded — hashing happens with the browser's Web Crypto API.
Paste content or fetch a URL to compute integrity hashes.
Frequently Asked Questions
Why did fetching my CDN URL fail?
Most CDNs don't send permissive CORS headers for arbitrary cross-origin fetches, so the browser blocks reading the response body. Paste the exact file content instead — the hash is identical either way since SRI only cares about the bytes.
Which hash algorithm should I use — sha256, sha384, or sha512?
sha384 is the de facto standard and what the ready-to-use snippet uses, but all three are valid per the SRI spec. Browsers accept any of them, and you can even list multiple in one integrity attribute for a fallback.
Does this hash the file exactly as the CDN serves it, byte-for-byte?
Only if you paste the exact response body or successfully fetch it. Any whitespace, encoding, or line-ending difference between what you hash and what the CDN actually serves will make the browser reject the resource at runtime.
Do I need crossorigin="anonymous" on the tag?
Yes — SRI validation requires the resource to be fetched in CORS mode, so both the integrity and crossorigin attributes need to be present together or the browser won't apply the check.
Can I use this for my own self-hosted assets too?
Yes. SRI works for any <script> or <link> tag regardless of origin; it's just most commonly used for third-party CDN resources where you don't control the server.