PIN THE BYTES YOU EXPECT

Subresource Integrity Hash Generator

Generate SHA-256, SHA-384 and SHA-512 integrity metadata for a local JavaScript or CSS file. Build escaped script, module or stylesheet snippets and compare an existing integrity attribute.

1. Choose the exact asset

Local file (20 MiB maximum)

No file selected.

Public asset URL (never fetched)

ElementSnippet hash

Expected integrity tokens (optional)

Standard canonical Base64 tokens only; unsupported algorithms, token options and URL-safe Base64 are rejected. Files are hashed in a local worker and never executed. 60-second job limit.

2. Copy a verified-byte snippet

Choose a local file or try the example.

All calculated hashes

HTML snippet (text only)

SRI checks byte equality, not whether code is trustworthy. Minification, changed line endings, BOM changes or CDN rewriting will change the hash. Test in your deployed page.

How to use integrity metadata

Select the final JS or CSS asset after your build and minification. Do not use a compressed .gz transport file in place of the actual asset bytes.
Enter its root-relative or HTTPS URL, choose the element type and calculate hashes. The URL is used only as snippet text.
Copy the snippet into your page and verify loading in the browser. Rebuild integrity metadata whenever the asset changes.

CORS and multiple hashes

Snippets use crossorigin="anonymous". Cross-origin asset servers must permit the request through CORS; this tool does not test server headers or deployed bytes. When expected metadata includes several supported algorithms, comparison uses only the strongest one present (SHA-512, then SHA-384, then SHA-256); any matching token at that strength passes the local comparison.

Adding integrity to one module entry does not automatically pin every imported dependency. This generator does not create signatures, configure Content Security Policy or fetch remote scripts.

Using Subresource Integrity Hash Generator

Pin the exact bytes of a final local JS or CSS asset in an HTML integrity attribute.

Choose the final asset after all build transformations.
Set its public URL and element type, then calculate integrity metadata.
Copy the snippet, deploy the matching asset and test CORS and browser loading.

Example

Try a local JavaScript sample; its bytes are hashed without executing the code.

Questions & answers

Does this fetch or run JavaScript?

No. It reads selected file bytes locally in a worker. The public URL is snippet text only. It neither fetches the URL nor executes selected code.

Why does my deployed file fail integrity checks?

The bytes may differ because of builds, line endings, minification or CDN rewriting, or cross-origin loading may fail CORS checks. Inspect the browser console and deployed response.

How does expected-metadata comparison work?

It uses the strongest supplied supported algorithm: SHA-512, then SHA-384, then SHA-256. Any matching token at that strength passes. Canonical standard Base64 tokens only; options and URL-safe Base64 are unsupported.

What are the limits?

One local file up to 20 MiB, 10,000 characters of expected metadata and a 60-second worker timeout. HTTPS or localhost and Web Crypto are required.

Does integrity mean my code is safe?

No. It checks bytes against an expectation; malicious code can also have a valid hash. Review your dependencies and keep hashes synchronized with reviewed releases.