About this tool
Create deployment-ready integrity attributes for public scripts and stylesheets while keeping byte scope and runtime checks explicit.
- Hashes the exact selected bytes with Web Crypto SHA-256, SHA-384, SHA-512, or all three under a 100 MB file limit.
- Parses bounded multi-token metadata and applies the W3C strongest-supported-algorithm set rule rather than comparing the entire string literally.
- Creates escaped script or stylesheet markup and versioned JSON evidence while separating local byte verification from deployment, CORS, HTTPS, and browser-load checks.
How to use SRI Generator
Load a local public asset, choose SHA-384 or another supported digest, generate the integrity value, and compare it exactly with the deployed asset bytes.
When this tool is useful
- Creating an integrity attribute for a versioned public asset.
- Checking a downloaded asset against an expected SRI value.
Practical tips
- Prefer immutable versioned asset URLs.
- Regenerate SRI after every byte change.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Generate script integrity
Example input
vendor-4.2.0.min.js with SHA-384
Expected output
sha384-... integrity value and script snippet
SRI complements HTTPS and does not replace origin security.
Validation checklist
- Hash the exact deployed bytes.
- Confirm algorithm and Base64 value.
- Test the final tag in the target page.