SRI Hash Generator
Generate Subresource Integrity hashes for scripts and stylesheets. SHA-256, SHA-384, and SHA-512 via Web Crypto API.
Select one or more. SHA-256 is the default; SHA-384 is widely recommended.
How to Use SRI Hash Generator
- 1Paste resource content or enter a URL.
- 2Select hash algorithms (SHA-256/384/512).
- 3Generate the integrity attribute value.
- 4Copy the complete script or link tag.
Zenovay
Privacy-first analytics for your website
Understand your visitors without invasive tracking. GDPR compliant, lightweight, and powerful.
Related Tools
Password GeneratorGenerate strong, random passwords with customizable length, characters, and complexity.
Password Strength CheckerCheck how strong your password is. Get an estimated crack time and improvement suggestions.
HMAC GeneratorGenerate HMAC signatures using SHA-256, SHA-384, or SHA-512 with the Web Crypto API.
AES Encryption/DecryptionEncrypt and decrypt text using AES-GCM with PBKDF2 key derivation. Runs entirely in your browser.
Frequently Asked Questions
What is Subresource Integrity (SRI)?▾
Subresource Integrity (SRI) is a browser security feature that lets you verify that resources fetched from third-party CDNs (scripts, stylesheets) have not been tampered with. You include a cryptographic hash in the integrity attribute of a <script> or <link> tag; if the fetched file does not match the hash, the browser refuses to execute it.
How does SRI work?▾
When a browser fetches a resource that has an integrity attribute, it computes a hash of the downloaded file and compares it against the value(s) in the integrity attribute. If the hash matches, the resource is executed or applied. If it does not match — because the file was modified or the CDN was compromised — the browser blocks the resource and logs a console error.
Which resources support SRI?▾
<script> and <link rel="stylesheet"> elements support SRI. Other resource types (images, fonts, iframes) do not currently use the integrity attribute. SRI is most useful for files served from third-party CDNs where you do not control the server.
Does SRI require CORS?▾
Yes. For cross-origin resources, the server must send a CORS header (Access-Control-Allow-Origin: *) and you must include crossorigin="anonymous" on the tag. Without this, the browser cannot read the response body to check the hash. Same-origin resources do not require the crossorigin attribute.
Which browsers support SRI?▾
SRI is supported in all modern browsers: Chrome 45+, Firefox 43+, Safari 11.1+, Edge 17+, and Opera 32+. Internet Explorer does not support SRI. For unsupported browsers the integrity attribute is silently ignored, so adding SRI is safe and backward-compatible.