Generate Subresource Integrity hashes for script and link tags to prevent CDN tampering attacks.
This tool turns file contents into the Subresource Integrity (SRI) hash that goes inside a script or link tag's integrity attribute, so the browser can reject anything a CDN has tampered with. It digests the exact bytes you enter and returns the ready-to-use value with the algorithm prefix, in the form sha384-.... The thing that surprises most people: the hash must be of the file exactly as served, byte for byte. Hash your local source file instead of the minified build the CDN actually serves, and every visitor's browser will block the resource.
A concrete input and expected output from the current implementation.
Input
abc
Expected output
sha384-ywB1P0WjXou1oD1pmsZQBycsMqsO3tFjGotgWkP/W+2AhgcroefMI1i67KE0yCWh
Hashing the three ASCII bytes of 'abc' with SHA-384 and base64-encoding the 48-byte digest yields that 64-character string; the sha384- prefix is the algorithm label the integrity attribute requires. For a real deployment, paste the file's exact served contents - change one byte and the whole digest changes.
The tool hashes the text you paste byte for byte and base64-encodes the raw digest, then prefixes the algorithm name and a dash to produce the value that goes inside integrity="...". Nothing about the URL, the file name, or the library version enters the hash, so the pasted content must be identical to what the browser will actually download.
When a tag carries an integrity attribute, the browser fetches the resource, computes the same digest, and compares the two. Any mismatch means the resource is discarded: scripts do not execute and stylesheets do not apply. For cross-origin files the tag must also include crossorigin="anonymous" and the CDN must answer with an Access-Control-Allow-Origin header, or the browser refuses the resource instead of loading it unverified.
For a cross-origin resource the tag needs crossorigin="anonymous" and the CDN must send an Access-Control-Allow-Origin header. Without both, the browser cannot read the response to verify it, so it blocks the resource rather than loading it unverified. The failure shows up in the console as an integrity or CORS error.
Yes. Any change to the served bytes - a patch release, a different minifier setting, even a line-ending conversion - produces a different digest, and the old integrity value blocks the new file. Regenerate the hash whenever the file's content changes and update the tag in the same deployment.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.