---
title: "SRI hash generator - free Subresource Integrity tool"
description: "Paste a CDN script or stylesheet URL and get its Subresource Integrity hash: SHA-256, 384 or 512, a ready-to-paste tag, and a CORS check. Free, no signup."
url: "https://centralcsp.com/en/tools/sri-hash/"
lang: "en"
---

Tools

# SRI hash calculator

Paste a script or stylesheet URL from a CDN and get its Subresource Integrity hash, to pin the exact file in your HTML.

Script or stylesheet URL [Learn how SRI works](https://centralcsp.com/en/docs/web-security/other/subresource-integrity)

256 384 512

Calculate SRI hash

Need a hash for your own inline script or style? [Use the CSP hash calculator](https://centralcsp.com/en/tools/csp-hash/)

Guide

## Understanding Subresource Integrity

Subresource Integrity (SRI) is the integrity attribute you add to a script or stylesheet loaded from another host, so the browser rejects the file if a CDN ever serves tampered code.

### What is a Subresource Integrity (SRI) hash?

An SRI hash is a base64-encoded SHA digest of the exact bytes of a file. You put it in the integrity attribute of a script or link tag; the browser hashes what it downloads, compares, and refuses the resource on any mismatch, treating it as a network error.

It defends against one specific threat: a third-party host or CDN that serves you tampered or compromised code. Because the value is tied to the exact file, an attacker who swaps the asset cannot make the browser run it. Read the full explanation in the [Subresource Integrity guide](https://centralcsp.com/en/docs/web-security/other/subresource-integrity).

```
<script
  src="https://cdn.example.com/app.min.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
  crossorigin="anonymous"></script>
```

### Which resources can carry an SRI hash?

Only two: a script tag, and a link tag whose rel is stylesheet, preload or modulepreload. On an image, an iframe, a video or a font the attribute is ignored, with no warning.

It is worth adding wherever the file is supposed to stay exactly as it is today:

-   A library pinned to a version on a public CDN
-   A stylesheet or icon font served from another host
-   A widget or SDK bundle at a URL that never changes
-   Your own build output, where the bundler writes the hashes for you

### Add the crossorigin attribute

For a file on another origin, add crossorigin="anonymous" next to integrity. A browser only verifies a cross-origin resource when the host allows the read with CORS, an Access-Control-Allow-Origin header. Without it the browser cannot check the file and ignores the integrity attribute, which is why this tool warns you when a URL is not CORS-readable.

The attribute pair is the same on both tags:

On a script

```
<script
  src="https://cdn.example.com/chart.min.js"
  integrity="sha384-Cbq7oAJVQfWCcGpuf3EmLpr4wqzBQKux9Hy8drVeoJXPFrWvNQ1kPzQho2wxJwY8"
  crossorigin="anonymous"></script>
```

On a stylesheet

```
<link
  rel="stylesheet"
  href="https://cdn.example.com/theme.css"
  integrity="sha384-VuArbKap7CY5uykM6oqf+R9GqQ8Kux9rx7HNQlGYl1kPzQho1wx4JwY8wCdgcRRap"
  crossorigin="anonymous">
```

### Where SRI stops working

A hash covers one file at one URL, so it stops at the first thing that moves:

-   Scripts that update at a fixed URL. A tag manager, an analytics loader or a payment SDK ships new bytes whenever the vendor decides, and a pinned hash blocks the page at the next release. Stripe.js is the clearest case: it must be loaded from js.stripe.com and accepts no hash at all.
-   Scripts injected by another script. The hash you put on a loader covers the loader, not the tags it goes on to add, which is what makes tag managers hard to pin in practice.
-   Files a cross-origin host will not serve with CORS. Without an Access-Control-Allow-Origin header the browser cannot read the file to check it, so it ignores the attribute.
-   Inline scripts, and stylesheets pulled in by a CSS @import. Use a CSP hash for the first and pin the importing stylesheet for the second.

### Requiring SRI across your site

SRI is opt-in: you add a hash tag by tag. The old CSP [require-sri-for directive](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/directives/require-sri-for) would have forced it site-wide, but it never shipped to a stable browser and is abandoned.

To require integrity across your whole site today, use the Integrity-Policy header: the browser blocks, or reports, any script loaded without valid SRI, turning a per-tag opt-in into an enforceable policy. Both are covered in the [Integrity-Policy guide](https://centralcsp.com/en/docs/web-security/policies/integrity-policy).

```
Integrity-Policy: blocked-destinations=(script)
```

### SHA-256, SHA-384, or SHA-512?

SRI accepts the same three algorithms as CSP. SHA-384 is the most common choice for SRI, but all three are equally safe here, so pick one and apply it consistently. You can even list several hashes on one tag: the browser accepts the file if the strongest algorithm it understands matches.

Keep reading

-   [Subresource Integrity](https://centralcsp.com/en/docs/web-security/other/subresource-integrity)
-   [The Integrity-Policy header](https://centralcsp.com/en/docs/web-security/policies/integrity-policy)
-   [Monitor Integrity-Policy reports](https://centralcsp.com/en/docs/platform/monitoring/integrity-policy)
-   [How to generate a Subresource Integrity hash](https://centralcsp.com/en/blog/generate-sri-hash)
-   [Protect CDN scripts with Subresource Integrity](https://centralcsp.com/en/blog/subresource-integrity-sri)
-   [Fix an Unsafe Implementation of Subresource Integrity finding](https://centralcsp.com/en/blog/fix-sri-security-finding)
-   [SRI hash vs CSP hash, the difference](https://centralcsp.com/en/blog/sri-vs-csp-hash)
-   [Generate SRI hashes automatically with webpack and Vite](https://centralcsp.com/en/blog/sri-webpack-vite)

More free tools

## Keep auditing with the other free tools

Every tool is free, runs without an account, and scores with the same severity scale.

### CSP scanner

Fetch a URL's live Content-Security-Policy and score it against known bypasses, wildcard sources and missing directives.

-   Directive-level findings
-   Shareable results link

[Run the CSP scanner](https://centralcsp.com/en/tools/csp-scanner/)

### CSP evaluator

Paste a policy that is not deployed yet and get the same scoring and findings as a live scan, no URL required.

-   Audit before you ship
-   Same scoring engine

[Evaluate a policy in the CSP evaluator](https://centralcsp.com/en/tools/csp-evaluator/)

### Security headers scanner

Grade every security header a URL sends, from HSTS to Permissions-Policy, with each finding explained and prioritized.

-   Every header, one grade
-   Fix list ordered by impact

[Scan your security headers](https://centralcsp.com/en/tools/security-headers/)

### Reporting API checker

Check that violation reporting actually works: endpoints, Reporting-Endpoints and Report-To, and which security features really report.

-   Endpoint and feature mapping
-   Silent drops flagged

[Check your Reporting API setup](https://centralcsp.com/en/tools/reporting-api/)

### CSP hash generator

Turn an inline script or style into the hash that lets it run under a strict policy, right in your browser.

-   Runs entirely client-side
-   SHA-256, 384 and 512

[Generate a CSP hash](https://centralcsp.com/en/tools/csp-hash/)

### Website compare

See where your score stands: your site beside the dataset average and the year's best-configured sites, control by control.

-   Published, auditable references
-   Radar view per category

[Compare your site to the best](https://centralcsp.com/en/tools/compare/)

FAQ

## Frequently asked questions

Integrity, CORS, algorithms and rotation, answered.

### What is a Subresource Integrity (SRI) hash?

A Subresource Integrity hash is a base64-encoded SHA digest of an external file's exact bytes, placed in the integrity attribute of a script or link tag. The browser fetches the file, hashes what it received, and refuses to execute or apply it unless the two match, so a CDN that starts serving different content is blocked rather than trusted.

### Why does SRI need crossorigin="anonymous"?

A browser will only verify the integrity of a cross-origin file it is allowed to read, and crossorigin="anonymous" is what makes the request CORS-enabled so it can read the response body. Without it, the browser cannot check the hash and ignores the integrity attribute entirely, which means the protection silently is not there. The file's host must also send an Access-Control-Allow-Origin header for this to work.

### Should I use SHA-256, SHA-384 or SHA-512?

SHA-384 is the common default for SRI and SHA-256 is equally safe in practice; all three are accepted by every browser that supports Subresource Integrity. The longer digests produce longer attributes with no meaningful security gain for this use. Pick one and apply it consistently, which makes a stale attribute easier to spot in review.

### Is an SRI hash the same as a CSP hash?

No. An SRI hash verifies the bytes of an external file the browser fetched, and it goes in the integrity attribute on the tag that loads it. A CSP hash allowlists one exact inline script or style already written into your HTML, and it goes in the script-src or style-src directive of your Content-Security-Policy. Both accept SHA-256, SHA-384 and SHA-512, which is where the confusion usually starts.

### Why is the browser blocking my script when the integrity hash looks right?

Usually because the file changed after you hashed it, or because the browser could not verify it at all. A CDN that published a new build serves different bytes and the pinned hash no longer matches. A cross-origin file served without an Access-Control-Allow-Origin header cannot be read for verification, and a missing crossorigin attribute has the same effect. The console message names which of the two happened.

### Do I need a new hash every time the CDN file changes?

Yes, and that is the trade-off you accept when you pin a file. An integrity attribute covers one exact build, so any new release invalidates it and the browser blocks the file until you update the attribute. The usual answer is to pin a versioned URL rather than a floating latest one, so the file at that address never changes underneath you.

### Is this SRI hash generator free?

Yes, it is free and needs no account. Enter a script or stylesheet URL and it returns the SHA-256, SHA-384 and SHA-512 digests together with a ready-to-paste tag. There is no usage limit to sign up for and no result gated behind a form.

## Track integrity on every page

An SRI hash pins one file, CentralCSP watches them all. Deploy an Integrity-Policy in report-only and catch a swapped third-party script the moment it changes, in your real visitors' browsers.

[Start with CentralCSP](https://app.centralcsp.com) [Track script integrity across every page](https://centralcsp.com/en/platform/supply-chain/)

---

Available in: [en](https://centralcsp.com/en/tools/sri-hash/), [fr](https://centralcsp.com/fr/tools/sri-hash/)