Free tool · no signup

SRI hash generator

Add an integrity hash to the scripts and stylesheets you load from a CDN, so the browser refuses a file that was changed. Pick the file, copy the tag. The file never leaves your browser.

By the Bug Circuit security team · Last updated October 31, 2026

The file to protect

Hash algorithmSHA-384 is the usual choice.Upload the exact file your page loadsDownload the script or stylesheet from the CDN, then pick it here. It is hashed in your browser and never uploaded.Or paste its contentsTag typeFile address

integrity value

Upload a file or paste its contents.

HTML tag

The tag appears here.

The hash must match the bytes the CDN serves, exactly. If the CDN changes the file (even a new version), the browser refuses to run it, so pin a version number in the URL.
The CDN must send the Access-Control-Allow-Origin header for the crossorigin attribute to work. Most public CDNs do.

What is Subresource Integrity? An integrity attribute on a script or link tag holding a hash of the file you expect. If the CDN, or an attacker who compromised it, serves anything different, the browser blocks it. Hash the exact file below and paste the tag.

How it works

Why a hash on a script matters

When your page loads a script from a CDN, you trust whoever runs that CDN, and everyone who can change the file there. Supply-chain attacks on popular scripts have hit thousands of websites at once. Subresource Integrity (a W3C standard) puts a hash of the expected file in your own HTML. The browser downloads the file, hashes it, and only runs it when the two match.

It is one of the cheapest protections against a compromised third-party script, and it costs nothing at runtime.

How to use the result

Download the exact file your page loads (the same version, the same URL), choose it above, and copy the tag. The hash is written as sha384-, followed by a base64 string. Add crossorigin="anonymous" as the tag does, because the browser needs the CDN to allow a cross-origin request to check the hash.

SRI only fits files that never change. Pin a version in the URL (library@1.2.3, not latest). If the CDN serves a different byte, even a new line, the browser blocks the script, so a mismatch shows up immediately in your browser console. It does not suit scripts that the vendor updates under the same URL, such as most analytics tags.

Which algorithm to choose

Use SHA-384 unless a tool asks for something else. SHA-256, SHA-384 and SHA-512 are all supported by browsers. You can list more than one hash for the same file, which lets you rotate algorithms.

Worked examples

Hash of a tiny script

The text: alert(1);

<script src="https://cdn.example.com/file.js" integrity="sha384-..." crossorigin="anonymous"></script>

The tool fills in the real hash for your file. A different file produces a completely different value.

A stylesheet

Choose Stylesheet as the tag type.

<link rel="stylesheet" href="https://cdn.example.com/site.css" integrity="sha384-..." crossorigin="anonymous">

The same attributes work on a link tag for CSS.

Frequently asked questions

What happens if the hash does not match?

The browser refuses to run the script or apply the stylesheet and logs an error in the console. That is the protection working.

Does SRI work for files on my own domain?

It can, but it matters most for third-party files. For your own files, a Content-Security-Policy and a build pipeline you control are the main defences.

Why do I need crossorigin="anonymous"?

Without it the browser cannot check a cross-origin file against a hash. The CDN must also send an Access-Control-Allow-Origin header, which most public CDNs do.

Can I use SRI on scripts that update often?

No. Any change to the file breaks the hash. Use it for pinned, versioned files, not for tags the vendor changes in place.

Is my file uploaded?

No. The hash is computed in your browser with the Web Crypto API.

Which browsers support SRI?

All current major browsers do. Older ones simply ignore the integrity attribute and load the file as before.

Keep reading

CSP GeneratorRestrict where scripts may load from.Security Headers GeneratorConfig for your server.Website Technology CheckerSee what your site loads.Is my website hackable?What attackers look at first.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing