Free Tool

SRI Hash Calculator

Generate Subresource Integrity hashes for external scripts and styles. Paste the exact file contents to produce integrity values.

Asset Contents

For accurate SRI values, hash the minified production asset.

Script or stylesheet content

Hash the shipped file

Subresource Integrity only works when the browser receives bytes that match the hash. Generate the value from the final minified JavaScript or CSS file served by your CDN, not from local source.

Prefer sha384

Browsers support SHA-256, SHA-384, and SHA-512 for SRI. SHA-384 is the common production default because it balances compatibility, token length, and security margin for third-party assets.

Keep CORS in mind

Cross-origin scripts and styles usually need crossorigin="anonymous" alongside the integrity attribute. If the asset changes without updating the hash, browsers will reject it instead of running stale or tampered code.