Skip to content
MtrXTools

SRI hash generator

Create Subresource Integrity (SRI) hashes for a script or stylesheet you paste or open, with ready-to-use script and link tags, and check an existing integrity attribute against the file. Runs in your browser.

What it does

  • Hashes a script or stylesheet you paste or open and gives sha256-, sha384- and sha512- integrity values, with sha384 as the usual choice.
  • Builds a ready-to-copy <script> or <link rel="stylesheet"> tag with integrity and crossorigin="anonymous", using the URL you enter.
  • Gives the curl ... | openssl dgst -sha384 -binary | openssl base64 -A command for a file hosted elsewhere, since a web page can't read another site's files.
  • Verifies an existing integrity attribute, including several space-separated values and ?options, and says whether the browser would load the file.
  • Points out CRLF line endings and a byte order mark in an opened file, two common reasons a hash doesn't match.

How Subresource Integrity works

The integrity attribute tells the browser what a script or stylesheet should hash to. The browser downloads the file, hashes the bytes and refuses to use it if the hash differs, so a compromised or changed CDN file can't run on your page. The value is the algorithm name, a dash, and the base64 of the binary digest (not the hex shown by sha384sum).

When the attribute lists several values, the browser looks only at the strongest algorithm present (sha512, then sha384, then sha256). If any value for that algorithm matches, the file loads. Cross-origin files also need crossorigin="anonymous" and a CORS header from the server, otherwise the browser blocks them.

Questions

Why is my SRI hash not matching?
The hash covers the exact bytes the server sends. A different version, minified vs unminified, CRLF vs LF line endings, a byte order mark or a missing final newline all change it. Hash the file as served (download it or use the curl command) rather than a copy from your editor.
Which algorithm should I use?
sha384 is the common choice and what most CDNs publish. sha256 and sha512 are also supported. All three are secure; MD5 and SHA-1 are not allowed in SRI.
Why does the browser say the resource was blocked by CORS?
With an integrity attribute on a cross-origin file, the browser needs crossorigin="anonymous" on the tag and an Access-Control-Allow-Origin header from the server. Public CDNs send it; your own asset host may need configuring.
Should I use SRI for files that change, like analytics scripts?
No. SRI pins one exact version, so a script the vendor updates in place will be blocked after the next change. Use it for versioned URLs, such as lib@1.2.3/lib.min.js.

Related tools