VoriTools

Subresource Integrity Hash Generator

Paste the exact script or stylesheet text to hash its UTF-8 bytes. The optional URL is used in the snippet; its content is not fetched.

Runs locally in your browser
View category: Security & Cryptography (30)
This tool processes all data locally in your browser.
Asset sourcePaste the exact bytes-as-text for a script or stylesheet. Hashes change when any character changes.
Algorithms

How to generate SRI integrity hashes

The page turns pasted JavaScript or CSS text into Subresource Integrity values with the Web Crypto API. It encodes the text as UTF-8, hashes the bytes with SHA-256, SHA-384 or SHA-512, and prints every digest as base64 in the sha256-… form a browser expects in an integrity attribute.

Everything runs in this tab: the text is not uploaded, no request is made while the tool works, and the optional resource URL is only copied into the HTML snippet you paste next to the script or stylesheet you are protecting.

  1. Paste the exact contents of the file into the source box. A textarea cannot carry binary data, so this fits readable JavaScript, CSS, JSON or HTML.
  2. Tick the algorithms you need. SHA-256 is enough for most assets; when several are listed, the browser picks the strongest one it supports.
  3. Optionally paste the URL the asset will be served from — it decides whether the snippet is a script or a stylesheet tag.
  4. Press Generate integrity. The output lists one line per algorithm, the integrity attribute, and the tag snippet.
  5. Copy the result or download it as sri-integrity.txt, then compare the digest with your build tool before you deploy.

What the hashes cover and what the page checks

What the page hashes

The input is read as text and encoded with TextEncoder, so the digest covers the UTF-8 bytes of exactly what is in the box. Paste abc and the first line is sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0= — the same value printf abc | openssl dgst -sha256 -binary | base64 prints. Every hash is base64 of the raw digest joined to the algorithm name with a dash, which is the format the integrity attribute uses.

A single character changes the digest, including a line ending. A file saved with CRLF endings, or a copy an editor re-wrapped, hashes differently from the deployed file. When a hash fails in production, compare the bytes rather than the text on screen.

The URL and the snippet

The URL field is used only to build the tag you paste into HTML. The page does not fetch it: no request leaves the browser while the tool works. A URL ending in .css, with an optional query or fragment, produces a <link rel="stylesheet" href="…" integrity="…" crossorigin="anonymous"> tag; anything else produces a <script src="…"> tag.

Only http://, https://, //host, /path and ./path or ../path URLs are accepted; quotes, spaces and angle brackets are refused, and the attribute values are escaped before they are written. An invalid URL stops the run with a message instead of copying a broken tag, and the earlier result is cleared rather than left on screen.

What SRI cannot do from this page

Subresource Integrity is a browser check: a script or stylesheet only runs when its bytes match the integrity value. The hashes prove integrity, not authenticity — whoever can change the file can recompute the hash. Nothing here verifies that the URL you typed serves those bytes; the asset is never downloaded.

Because the input is a text box, the tool cannot hash a binary file, a compressed bundle or a file in another encoding — open those in a shell and run the same digest command. The URL field is not a check either; it only saves you from writing the tag by hand.

Recent tools: