Subresource Integrity Generator & Verifier
Generate and verify SRI hashes from UTF-8 text or raw local files with native Web Crypto.
Resource
Integrity output
Ready.
HTML snippet — text only
Text uses UTF-8; raw files retain their exact bytes. No trimming, execution or upload. Cross-origin SRI resources require permission from the resource server through CORS and appropriate crossorigin behavior; these snippets use anonymous. SRI does not bypass CORS or prove content is safe.
Generate an integrity value from exact resource bytes.
Choose SHA-256, SHA-384 or SHA-512. Text is encoded as UTF-8 without trimming. Local files retain raw bytes, including line endings, byte-order marks and binary data. Text pasted into a browser may have different line endings from a downloaded file. Use the exact deployed file when byte identity matters. The output uses standard Base64, never hexadecimal. Empty resources are valid.
Verify the strongest supported metadata.
Paste one or more whitespace-separated integrity tokens. The verifier compares decoded digest bytes for the strongest supported algorithm present; any matching digest at that strength succeeds. A weaker match cannot override a stronger mismatch. Unsupported algorithms are ignored when supported tokens exist. Malformed supported tokens, invalid Base64 and metadata options are rejected explicitly. This strict validation is not a complete browser metadata parser. Byte comparison avoids early exit but makes no JavaScript constant-time guarantee.
Snippets remain inert text.
Generate a script or stylesheet element with an escaped HTTP(S) resource URL, integrity value and crossorigin="anonymous". The URL is never retrieved. Cross-origin resources must also permit access through CORS on the resource server; SRI does not bypass CORS. A digest checks byte identity, not whether code is trustworthy. No uploaded scripts, styles or markup are executed.
Local limits and browser support.
Web Crypto requires HTTPS or localhost. Text is limited to 128 KiB of UTF-8, local files to 1 MiB, integrity metadata to 4,096 characters and 16 tokens, and snippet URLs to 2,048 characters. Inputs stay in memory and clear on reset or page exit. Pending results can be discarded; native digest work cannot be interrupted. Remote resource fetching and Integrity-Policy header authoring are outside this tool.