# SRI Hash Generator

Drop a JavaScript or CSS file to get the integrity value (sha384-…) and a ready-to-use script or link tag. Paste an existing integrity value to check whether it matches the file.

- URL: https://tools.itlibra.com/en/sri-generator
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. Drop a JavaScript or CSS file into the drop area on the left. You can also paste text and choose “Make hash from text”.
2. Choose the hash algorithm (sha384 by default). sha256 and sha512 values are computed at the same time.
3. Enter the URL or path where the file is served in the src field; the tag updates to use it.
4. Copy the integrity value or the tag and add them to your script or link element.
5. To check an existing integrity attribute, paste it into the check field to see whether it matches the file.

## Use cases

- Add integrity to a \<script\> that loads jQuery or another library from a CDN
- Regenerate the integrity value of a \<link\> after changing your own stylesheet
- Check that a downloaded file matches the value published by its provider
- Confirm that an external script is unchanged before you load it on your site

## What it does

### sha256, sha384 and sha512

The values of all three algorithms are computed in one read. The default is sha384.

### Tags ready to paste

script and link tags are built with integrity and crossorigin="anonymous". You can change the src; quotes and angle brackets are escaped.

### Check an existing integrity

Reads several hashes separated by spaces. When there are several, only the strongest algorithm decides, as W3C SRI specifies.

### Shows the line-ending style

Pasted text is hashed as UTF-8 bytes, and the tool shows whether it uses LF or CRLF, because a different line ending gives a different hash.


## Supported formats

### Input

- Files (.js, .css or any file, up to 100 MB each)
- Pasted text (up to 10 MB)

### Output

- integrity values (sha256, sha384, sha512)
- script and link HTML tags


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Make integrity values from files and pasted text | Supported | — |
| script and link tags with crossorigin | Supported | — |
| Check against an existing integrity (several hashes) | Supported | — |
| Fetch a served file from a URL and hash it | Not supported | Save the file and add it here |
| Read integrity attributes from a live page | Not supported | Only the values you paste are checked |
| Algorithms that SRI does not define (such as md5 or sha1) | Not supported | — |

## Limits & notes

- The tool never fetches a URL. Save the same file that is served and build the value from it.
- Files up to 100 MB each; pasted text up to 10 MB.
- If a CDN or server compresses the file or changes its line endings, the hash changes. Rebuild it from the file as served.
- For a file from another origin without the crossorigin attribute, the browser blocks the request when integrity is set.

## Privacy & safety

Files and pasted text are processed only in your browser. Nothing is sent to or stored on a server.

## FAQ

### Which should I use: sha256, sha384 or sha512?

The W3C SRI specification allows all three. This tool defaults to sha384. If you list several, the browser decides by the strongest one only.

### Can I generate the hash of a CDN file directly?

No. The tool does not fetch URLs, so save the file from your browser and add it here. If it is byte-for-byte what the CDN serves, the value matches.

### Does changing line endings change the hash?

Yes. LF and CRLF are different bytes and give different hashes. Pasted text is hashed exactly as shown, including its line endings.

### Is crossorigin="anonymous" required?

Yes, for a file from another origin such as a CDN. Without it, the browser blocks the request for that file when integrity is set.

### Why does a check say mismatch?

The file differs (line endings, compression or another version), or the pasted value is out of date. Rebuild the value from the file as it is served and compare again.