Skip to content
TextArray1.109.0
100% local

Subresource integrity generator

Compute an SRI hash for pasted file content and build the matching script or link tag.

File content
Output
Related tools
Hash generatorDeveloper tools
CSP header generatorDeveloper tools
Favicon HTML generatorDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
Subresource integrity generator
Paste the exact content of a script or stylesheet and this tool computes its Subresource Integrity (SRI) hash, then assembles a ready-to-use <script> or <link> tag around it. SRI lets a browser verify that a file loaded from a CDN or another origin has not been tampered with — the browser refuses to run it if the fetched bytes don't match the hash you provide.
Choose SHA-256, SHA-384 or SHA-512, or tick more than one box to produce a combined integrity value listing several algorithms at once — a browser picks the strongest one it supports. Pick the tag type (script or link), fill in the source URL, and set the crossorigin value your CDN expects (anonymous is correct for almost every public CDN). For a script tag you can also add defer or async. Switch the output to "integrity value only" when you just need the attribute value to paste into markup you already have.
The hash is computed on the exact bytes you paste, including whatever line endings the file was saved with — a browser checks a resource's real bytes, so normalizing them here would produce a hash that no longer matches the actual file. Very large files are supported up to the tool's usual size limit.
Everything happens locally in your browser: the content you paste is never uploaded anywhere, which matters since it's often the exact source of a script you're about to publish. Copy the result, download it as a .txt file, or clear the fields and start over.
FAQ
What is Subresource Integrity (SRI)?
SRI is a browser security feature. You give a <script> or <link> tag an integrity attribute containing a hash of the expected file; if the file the browser actually fetches doesn't match, it refuses to run it.
Which algorithm should I choose?
SHA-384 is the most common default and what most CDNs generate by default. SHA-256 is shorter and still secure; SHA-512 is the strongest but produces the longest value. Selecting more than one lets the browser pick the strongest it supports.
What does crossorigin do here?
It's required alongside integrity for a cross-origin resource, since the browser has to make a CORS request to check the response before running it. "anonymous" is correct for public CDN files that don't need cookies.
Why doesn't the hash change if I only fix a typo in the URL?
The integrity value only depends on the file content you pasted, never on the URL — the URL is just where the tag tells the browser to fetch the file from.
Is the file content I paste uploaded anywhere?
No. The hash is computed entirely in your browser using the Web Crypto API — the content never leaves your device.