SRI Hash Generator

Many sites load scripts and styles from a content delivery network. That is convenient and fast, and it means your page runs whatever the CDN serves. If the CDN or the library’s publisher is compromised, every site that includes the file is compromised with it. Subresource Integrity, a W3C standard supported by all current browsers, lets your page say what the file must look like. The browser downloads it, hashes it and refuses to run it if the hash is different. This page produces the hash and the tag.

The attribute

The integrity attribute holds one or more tokens of the form sha384- plus a Base64 string. The Base64 is the digest of the file’s exact bytes. Browsers support SHA-256, SHA-384 and SHA-512. If you give several tokens, separated by spaces, the browser uses the strongest algorithm it knows and accepts the file if any token of that strength matches, which makes it possible to list two valid versions during a rollout. SHA-384 is the usual choice and the one most CDNs publish.

A worked example

Press Sample. The text is alert('Hello, world.');, 23 bytes with no trailing newline. The page gives three values: sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng=, sha384-H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO and a longer sha512 value. It then writes a ready tag for the resource URL you enter, for instance <script src="https://cdn.example.com/app.min.js" integrity="sha384-H8BRh8j4…" crossorigin="anonymous"></script>. A single trailing newline would change every digest, which is why the page hashes exactly what you paste or open.

Why crossorigin matters

For a file from another origin, the browser checks integrity only if the request is made in CORS mode. That needs the crossorigin="anonymous" attribute on your tag and an Access-Control-Allow-Origin header from the server. Public CDNs send that header. If it is missing, the browser cannot read the bytes for checking and blocks the file. The tag builder adds the attribute for you.

Hash the delivered bytes

The hash has to match what the server delivers, not what is in your repository. A CDN may serve a minified or compressed variant, and some rewrite files. Compression like gzip does not matter, since the browser hashes the decoded bytes, but minification does. Open the file by its final URL, save it, and hash that file here. The “check an integrity value you were given” box recomputes a value from your content and tells you whether it matches.

Where SRI fits

SRI protects against changed third-party files. It does not protect against a malicious script that was always malicious, and it does not limit what an allowed script may do. Combine it with a Content-Security-Policy and with pinned library versions in the URL.

Limits

The page does not fetch files from the web, so open or paste the content yourself. It hashes locally. SRI works for script and link elements, not for dynamically created requests such as fetch or images.

Related tools

• CSP Script Hasher hashes inline scripts for a Content-Security-Policy.
• CSP Generator and Evaluator builds the policy that works alongside SRI.
• Hash Generator computes the same digests in hex.
• Security Headers Generator and Auditor reviews the rest of your response headers.