SRI Hash Generator
SRI Hash Generator hashes the exact UTF-8 text in the editor with SHA-256, SHA-384, or SHA-512 and formats algorithm-base64 output for an integrity attribute. It does not download a referenced asset or inspect file bytes. The value matches a deployed resource only when the pasted bytes—including line endings and encoding—are identical.
Runs locally — files stay on your deviceWhy might an SRI value generated from pasted code fail?
Pasting can change line endings, encoding, whitespace, or omit bytes; SRI must hash the exact served resource body.
Subresource Integrity binds markup to exact resource bytes
A browser fetches a supported script or stylesheet, hashes its response body, and loads it only when an accepted integrity digest matches. SRI detects unexpected byte changes; it does not review whether the original code was safe.
How it works
Paste text and select a SHA-2 algorithm. Web Crypto digests its UTF-8 bytes, Base64-encodes the digest, and prefixes sha256-, sha384-, or sha512-.
Key concepts
One-byte changes break the match
Whitespace and line endings are part of the resource.
Cross-origin loading has additional requirements
CORS and element configuration affect whether cross-origin SRI can succeed.
When to use it
- Reproduce an integrity value for a known text fixture.
- Learn SRI output syntax.
- Check exact pasted UTF-8 content against another calculation.
When not to use it
- Do not assume pasted text equals a remote file byte-for-byte.
- Do not use SRI as malware analysis.
- Do not expect dynamically changing resources to keep one hash.
Worked examples
Stable script text
- Input
Exact contents of app.js- Expected output
sha384-…
The deployed response must contain identical bytes.
Changed newline
- Input
Same visible code with CRLF instead of LF- Expected output
Different digest
Byte sequences differ.
Algorithm switch
- Input
Same text with SHA-256 and SHA-512- Expected output
Different prefixes and lengths
The selected algorithm is encoded in the value.
Common mistakes
Hashing a URL string
SRI hashes resource content, not its address. Correction: Hash the exact response bytes.
Copy-pasting through a formatter
Whitespace or line endings may change. Correction: Use a tool that hashes the actual deployed file.
Assuming integrity means safe code
SRI only checks equality with the chosen bytes. Correction: Review and trust the pinned source separately.
Best practices
- Generate hashes from release artifacts.
- Pin immutable versioned resources.
- Test crossorigin and integrity behavior in the deployed page.
Related operations and differences
JWT Header Viewer
Choose JWT Header Viewer when you need to decode a JWT header without verifying its signature.; use SRI Hash Generator specifically for sri.
Password Entropy Calculator
Choose Password Entropy Calculator when you need to calculate estimated entropy from an assumed character pool.; use SRI Hash Generator specifically for sri.
Password Strength Checker
Choose Password Strength Checker when you need to estimate password entropy without transmitting it.; use SRI Hash Generator specifically for sri.
Basic Auth Header Generator
Choose Basic Auth Header Generator when you need to generate a Basic Authorization header locally.; use SRI Hash Generator specifically for sri.
HMAC Generator
Choose HMAC Generator when you need to create an HMAC using the browser Web Crypto API.; use SRI Hash Generator specifically for sri.
JWT Expiration Checker
Choose JWT Expiration Checker when you need to inspect the exp claim in a JWT.; use SRI Hash Generator specifically for sri.
Limitations and privacy
- Hashes pasted UTF-8 text, not uploaded files or fetched resources.
- No URL retrieval, CORS validation, HTML generation, or deployment check.
- Cannot assess source trust or code safety.
The entered value is processed locally in this browser. Avoid using an untrusted device for real credentials or secrets.
Frequently asked questions
Does it download a CDN file?
No.
Does whitespace matter?
Yes.
Can SRI prove code is harmless?
No.
Which algorithms are offered?
SHA-256, SHA-384, and SHA-512.