valtrinity
Go Unlimited

SRI Hash Generator

Choose the file you load on your page, or paste its contents, and get SHA-256, SHA-384 and SHA-512 integrity values with a ready-made tag.

Worked examples

A small file

File contents: abc, hash SHA-256

sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0=

This is the Base64 form of the well-known SHA-256 value ba7816bf... for abc.

About SRI Hash Generator

When your page loads a script or style sheet from another host, you are trusting that host to serve the same file tomorrow as it does today. If the file is changed, by a break-in or by a mistake, your visitors run the changed version. Subresource integrity closes that gap. You add an integrity value, the hash of the file you expect, to the tag. The browser downloads the file, works out its hash and refuses to use it unless the two match.

This page makes the value for you. Choose the file from your computer, or paste its contents, and the SHA-256, SHA-384 and SHA-512 values appear together with a complete script or link tag, ready to paste into your page. SHA-384 is the usual choice, and you can put all three in one tag if you want. The hash is of the exact bytes you supply, so use the file as it is served, and make a new value whenever you update the file.

How to use SRI Hash Generator

  1. Choose the file you load on your page, or paste its contents into the box.
  2. Pick whether it is a script or a style sheet, and which hash to put in the tag.
  3. Type the address the file is loaded from so it is included in the tag.
  4. Copy the finished tag into your page, replacing the old one.

Common uses

  • Pinning a library that you load from a content delivery network
  • Protecting a payment or sign-in page from a changed script
  • Updating the hash after you upgrade a library
  • Checking that a downloaded file matches the one you reviewed

Frequently asked questions

What happens if the hash does not match?

The browser does not run the script or apply the style sheet, and writes an error in the console. That is the point of the feature, but it also means a wrong hash breaks the page, so test after you add it.

Why does my hash differ from the one a library publishes?

The hash is of the exact bytes. A different line ending, a trailing space or a changed copy of the file gives a different value. Choose the file itself rather than pasting, and make sure it is the same version the address serves.

Why do I need crossorigin anonymous?

For a file from another host, the browser can only check the hash if the file is fetched in cross-origin mode, and the host must allow it. Without the attribute the check can fail even when the hash is right.

Which hash should I choose?

SHA-384 is the common choice and is supported everywhere. SHA-256 is shorter and SHA-512 is longer, and all are strong enough. If you list several, the browser uses the strongest it supports.

Does it work with files that change often?

Not well. If an address always serves the latest version, the hash will stop matching when the file is updated. Pin a version in the address, or host the file yourself.

Six tools that go with this one

Hash GeneratorCreate SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files.CSP Header BuilderBuild a Content-Security-Policy header by choosing where each kind of content may come from.CSP EvaluatorPaste a Content-Security-Policy and see which parts are weak, with a grade and plain explanations.Base64 Encode & DecodeEncode text to Base64 or decode it back, with URL-safe output.Security Headers CheckerGrade a site's HTTP security headers from A to F.HMAC GeneratorCreate an HMAC signature of a message with SHA-256, SHA-512, SHA-1, SHA-384 or MD5.