SRI Hash Generator

Subresource Integrity lets a browser verify that a script or stylesheet fetched from a CDN or third-party host is exactly the bytes expected, not a tampered or compromised substitute. The browser hashes what it downloads and refuses to execute it if the digest does not match the integrity attribute.

This hashes whatever text is pasted here — it does not fetch a URL. The value is only correct if the pasted text is byte-for-byte the same file a <script>/<link> tag will actually load, which is why the tool cannot verify that for you; that check belongs to whoever controls the deployed file.

Which algorithm to pick

All three — sha256, sha384 and sha512 — are generated at once. sha384 is the most common in published examples and CDN documentation, but a browser accepts any of the three, so publishing all of them costs nothing and covers whatever a consuming tool expects.

Pasting console.log("hello"); produces a ready-to-paste snippet: <script src="..." integrity="sha384-..." crossorigin="anonymous"></script> — the crossorigin attribute is required for a cross-origin resource, since without it the browser never exposes the response to the integrity check at all.