# How to Generate an SRI Hash

> Generate Subresource Integrity hashes for external scripts and stylesheets. Protect your site from compromised CDN resources.

- URL: https://www.browserutils.dev/how-to/generate-sri-hash
- Published: 2026-08-11
- Updated: 2026-07-02

---

## Step 1: Enter the resource URL or content

Paste the URL of the external script or stylesheet, or paste the file content directly. The tool fetches the resource and computes the hash.

## Step 2: Choose the hash algorithm

Select SHA-256, SHA-384, or SHA-512 as the hash algorithm. SHA-384 is the most commonly used and recommended for SRI.

## Step 3: Generate the integrity hash

The tool computes the cryptographic hash of the resource content and formats it as a valid SRI integrity attribute value.

## Step 4: Add the integrity attribute

Copy the generated hash and add it as an integrity attribute on your script or link tag, along with crossorigin='anonymous' for cross-origin resources.

When you load JavaScript or CSS from a third-party CDN, you are trusting that the file has not been tampered with. If the CDN is compromised or a supply-chain attack swaps the file, your users execute malicious code with full access to your page. Subresource Integrity (SRI) eliminates this risk by letting the browser verify a cryptographic hash before executing the resource. The [SRI hash generator](/tools/sri-hash-generator) computes the correct hash so you can add the `integrity` attribute in seconds.

## Understanding how SRI works

When you add an `integrity` attribute to a `<script>` or `<link>` tag, the browser downloads the resource, computes its cryptographic hash, and compares it to the hash you specified. If they match, the resource loads normally. If they don't — because the file was modified, corrupted, or replaced — the browser refuses to execute it and logs a network error.

The hash is a Base64-encoded digest prefixed with the algorithm name. A typical attribute looks like:

```html
<script src="https://cdn.example.com/lib.js"
        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxAh1..."
        crossorigin="anonymous"></script>
```

The `crossorigin="anonymous"` attribute is required for cross-origin resources because SRI needs access to the response body to compute the hash, which requires CORS.

You can specify multiple hashes with different algorithms (e.g., both `sha256-...` and `sha384-...`) for forward compatibility. The browser uses the strongest algorithm it supports.

## Tips and best practices

- **Use SHA-384 as your default algorithm.** It strikes the right balance between security and performance. SHA-256 is also acceptable, while SHA-512 adds minimal security benefit for the extra length.
- **Pin exact versions from CDNs.** SRI only works with files that never change. Always reference a specific version URL like `jquery@3.7.1/dist/jquery.min.js`, not a `latest` or floating version URL.
- **Regenerate hashes after any update.** When you upgrade a library version, the file content changes and the old hash will cause the browser to block it. Update the `integrity` attribute every time you change the `src`.
- **Pair SRI with a CSP `require-sri-for` directive.** This tells the browser to require integrity attributes on all scripts and styles, catching any tags you forgot to protect.
- **Need a hash for something other than SRI?** Use the general-purpose [Hash Generator](/tools/hash-generator) for checksums, file verification, or other cryptographic hashing tasks outside the `integrity` attribute format.

## Common issues

- **Resource blocked after CDN update.** If a CDN recompresses or reformats a file (changing whitespace or encoding), the hash changes even though the logical content is the same. Always generate your hash from the exact file the CDN serves, not a local copy.
- **SRI failing for dynamically loaded scripts.** The `integrity` attribute only works on `<script>` and `<link>` elements in HTML. If you load scripts programmatically with `document.createElement('script')`, you need to set the `integrity` property on the element before appending it to the DOM.
- **CORS errors when adding `crossorigin`.** The CDN must respond with an `Access-Control-Allow-Origin` header. Most public CDNs do this by default, but private or internal CDNs may not. Without CORS, SRI cannot function for cross-origin resources.