日本語English

SRI Hash Generator

Drop a JavaScript or CSS file to get the integrity value (sha384-…) and a ready-to-use script or link tag. Paste an existing integrity value to check whether it matches the file.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Drop JS, CSS or any other file

or

Files are not uploaded. Hashes are computed on this device.Accepts: Up to 100 MB per file (several allowed)Paste (Ctrl+V) also works

Hash algorithm

Default is sha384. sha256 and sha512 are computed at the same time.

Or make it from pasted text

Text is hashed as UTF-8 bytes. LF and CRLF line endings produce different hashes.

You can paste several hashes separated by spaces. When there are several, only the strongest algorithm (sha512 > sha384 > sha256) decides, as in W3C SRI.

Generated tags

Drop a file or paste text to see the integrity value and HTML tag here.

  • This tool never fetches a URL. Save the same file that is served and build the value from that file.
  • If a CDN or server compresses the file or changes its line endings, the hash changes. Rebuild it from the file as served.
  • For a file from another origin (for example a CDN), the crossorigin attribute is required. Without it, the browser blocks the request.

How to use

  1. Drop a JavaScript or CSS file into the drop area on the left. You can also paste text and choose “Make hash from text”.

  2. Choose the hash algorithm (sha384 by default). sha256 and sha512 values are computed at the same time.

  3. Enter the URL or path where the file is served in the src field; the tag updates to use it.

  4. Copy the integrity value or the tag and add them to your script or link element.

  5. To check an existing integrity attribute, paste it into the check field to see whether it matches the file.

What it does

sha256, sha384 and sha512

The values of all three algorithms are computed in one read. The default is sha384.

Tags ready to paste

script and link tags are built with integrity and crossorigin="anonymous". You can change the src; quotes and angle brackets are escaped.

Check an existing integrity

Reads several hashes separated by spaces. When there are several, only the strongest algorithm decides, as W3C SRI specifies.

Shows the line-ending style

Pasted text is hashed as UTF-8 bytes, and the tool shows whether it uses LF or CRLF, because a different line ending gives a different hash.

Use cases

  • Add integrity to a <script> that loads jQuery or another library from a CDN
  • Regenerate the integrity value of a <link> after changing your own stylesheet
  • Check that a downloaded file matches the value published by its provider
  • Confirm that an external script is unchanged before you load it on your site

Supported formats

Input

Files (.js, .css or any file, up to 100 MB each)Pasted text (up to 10 MB)

Output

integrity values (sha256, sha384, sha512)script and link HTML tags

Capability matrix

FeatureSupportNotes
Make integrity values from files and pasted textSupported—
script and link tags with crossoriginSupported—
Check against an existing integrity (several hashes)Supported—
Fetch a served file from a URL and hash itNot supportedSave the file and add it here
Read integrity attributes from a live pageNot supportedOnly the values you paste are checked
Algorithms that SRI does not define (such as md5 or sha1)Not supported—

Limits & notes

  • The tool never fetches a URL. Save the same file that is served and build the value from it.
  • Files up to 100 MB each; pasted text up to 10 MB.
  • If a CDN or server compresses the file or changes its line endings, the hash changes. Rebuild it from the file as served.
  • For a file from another origin without the crossorigin attribute, the browser blocks the request when integrity is set.

Privacy & safety

Files and pasted text are processed only in your browser. Nothing is sent to or stored on a server.

FAQ

Which should I use: sha256, sha384 or sha512?
The W3C SRI specification allows all three. This tool defaults to sha384. If you list several, the browser decides by the strongest one only.
Can I generate the hash of a CDN file directly?
No. The tool does not fetch URLs, so save the file from your browser and add it here. If it is byte-for-byte what the CDN serves, the value matches.
Does changing line endings change the hash?
Yes. LF and CRLF are different bytes and give different hashes. Pasted text is hashed exactly as shown, including its line endings.
Is crossorigin="anonymous" required?
Yes, for a file from another origin such as a CDN. Without it, the browser blocks the request for that file when integrity is set.
Why does a check say mismatch?
The file differs (line endings, compression or another version), or the pasted value is out of date. Rebuild the value from the file as it is served and compare again.

File Hash — Checksum Calculator & Verifier

Drop a file to get its SHA-256 (and more); paste the published hash to see match or mismatch instantly. Even multi-gigabyte ISOs are read in chunks on your own device — nothing is uploaded.

No upload

CSP Studio

Paste a Content-Security-Policy header or meta tag to see unsafe-inline, unsafe-eval, wildcards and missing object-src or base-uri, ranked high, medium or low, with a suggested policy. Generation and hash calculation are included.

No upload

Crypto Studio — Hash, HMAC, Encryption & Keys

Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.

No upload

security.txt Generator & Checker

A security.txt file tells security researchers where to report a vulnerability. Fill in Contact and Expires to get a file that follows RFC 9116, or paste an existing file to see line-numbered problems.

No upload

HTML Inspector

Paste a page’s HTML to review SEO and accessibility basics at a glance: heading structure, meta tags, Open Graph, image alt text, links and structured data — with a preview of how it may look in search and on social media.

No upload

robots.txt Tester

Paste a robots.txt to see instantly whether a URL is allowed or blocked for Googlebot or AI crawlers, and which line decided it. Misspellings and directives Google ignores are flagged too.

No upload

Last updated: