Generate Subresource Integrity hashes for script and link tags. Paste a CDN URL or file to compute sha256/sha384/sha512.
Paste a CDN URL or the file itself and this tool computes the digest that goes in a script or link tag's integrity attribute, returning sha256, sha384, and sha512 forms ready to copy. The hash covers the file's exact bytes, so it is valid only for that exact version of that exact file: a stray newline, a CRLF conversion, or a CDN republish changes it, and the browser then refuses to run or apply the resource. The usual mistake is hashing different bytes than the browser fetches - copy-pasting from a rendered page instead of the raw file. Computation happens in the browser; nothing is uploaded.
A concrete input and expected output from the current implementation.
Input
abc (the three characters with no trailing newline, pasted as file content)
Expected output
sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3pctBD/YeQAFa0=
abc is the standard published test vector for SHA-256: the digest is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, which base64-encodes to ungWv48Bz+pBQUDeXa4iI7ADYaOWF3pctBD/YeQAFa0=, and the tool prefixes it with sha256-. The result assumes exactly three bytes: add a newline and every character of the output changes.
The tool hashes the input bytes with SHA-256, SHA-384, or SHA-512, base64-encodes the digest, and prefixes it with the algorithm name and a hyphen, so the result looks like sha256-<base64>. That whole string is the integrity attribute value. Because base64 encodes raw bytes, the result depends on the exact input bytes: text pasted from different sources can carry different line endings and yield different hashes.
With integrity set, the browser computes the digest of the fetched response and compares it with the hash in the attribute; a space-separated list passes when any one entry matches. A mismatch is a hard failure - the script never executes and the stylesheet is never applied. For cross-origin resources the check runs only when the tag has crossorigin and the server sends CORS headers.
No. The integrity check runs on the file's content after transfer decoding, so gzip or brotli on the wire does not change the hash. Edits to the file itself do - including a trailing newline a CDN repackaging step might add.
Yes. The value is a space-separated list, and the resource passes if it matches any listed hash. Including both a sha256 and a sha384 of the same file is a common hedge when tooling or policies expect a particular algorithm.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.