How to Generate an SRI Hash

When you load JavaScript or CSS from a third-party CDN, you are trusting that the file has not been tampered with. If the CDN is compromised or a supply-chain attack swaps the file, your users execute malicious code with full access to your page. Subresource Integrity (SRI) eliminates this risk by letting the browser verify a cryptographic hash before executing the resource. The SRI hash generator computes the correct hash so you can add the integrity attribute in seconds.

Understanding how SRI works

When you add an integrity attribute to a <script> or <link> tag, the browser downloads the resource, computes its cryptographic hash, and compares it to the hash you specified. If they match, the resource loads normally. If they don’t — because the file was modified, corrupted, or replaced — the browser refuses to execute it and logs a network error.

The hash is a Base64-encoded digest prefixed with the algorithm name. A typical attribute looks like:

<script src="https://cdn.example.com/lib.js"
        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxAh1..."
        crossorigin="anonymous"></script>

The crossorigin="anonymous" attribute is required for cross-origin resources because SRI needs access to the response body to compute the hash, which requires CORS.

You can specify multiple hashes with different algorithms (e.g., both sha256-... and sha384-...) for forward compatibility. The browser uses the strongest algorithm it supports.

Tips and best practices

• Use SHA-384 as your default algorithm. It strikes the right balance between security and performance. SHA-256 is also acceptable, while SHA-512 adds minimal security benefit for the extra length.
• Pin exact versions from CDNs. SRI only works with files that never change. Always reference a specific version URL like jquery@3.7.1/dist/jquery.min.js, not a latest or floating version URL.
• Regenerate hashes after any update. When you upgrade a library version, the file content changes and the old hash will cause the browser to block it. Update the integrity attribute every time you change the src.
• Pair SRI with a CSP require-sri-for directive. This tells the browser to require integrity attributes on all scripts and styles, catching any tags you forgot to protect.
• Need a hash for something other than SRI? Use the general-purpose Hash Generator for checksums, file verification, or other cryptographic hashing tasks outside the integrity attribute format.

Common issues

• Resource blocked after CDN update. If a CDN recompresses or reformats a file (changing whitespace or encoding), the hash changes even though the logical content is the same. Always generate your hash from the exact file the CDN serves, not a local copy.
• SRI failing for dynamically loaded scripts. The integrity attribute only works on <script> and <link> elements in HTML. If you load scripts programmatically with document.createElement('script'), you need to set the integrity property on the element before appending it to the DOM.
• CORS errors when adding crossorigin. The CDN must respond with an Access-Control-Allow-Origin header. Most public CDNs do this by default, but private or internal CDNs may not. Without CORS, SRI cannot function for cross-origin resources.