SRI Hash Generator
Note: Leaving off crossorigin="anonymous" is the usual cause of a resource being blocked with a hash that is actually correct — without it the response is opaque to the check, so the browser blocks rather than verifies.
SHA-384 is the usual choice. SHA-256 is not meaningfully weaker for this purpose, and SHA-512 produces a longer attribute for no practical gain, but 384 is what the specification's examples use and what nearly every CDN publishes, so it is the one that will match if you cross-check.
The attribute that people leave off is crossorigin. Without it the browser fetches the resource in a mode that hides the response from the integrity check, and the file is blocked rather than verified — which reads as a broken hash and sends everyone hunting for the wrong problem. Any cross-origin resource with an integrity attribute needs crossorigin="anonymous" alongside it, and the generated tags include it.
The crucial constraint is that the hash covers those exact bytes. A CDN that minifies on the fly, appends a comment, or serves a slightly different build to different regions will break the check every time, which is why SRI belongs on version-pinned URLs and not on a URL with 'latest' in the path.
Frequently Asked Questions
Why is my resource blocked when the hash looks correct?
Almost always the missing crossorigin attribute. Without it the response is opaque to the integrity check and the browser blocks the file instead of verifying it. Add crossorigin="anonymous" to the tag; the resource also has to be served with a permissive CORS header, which every major CDN does.
Which algorithm should I use?
SHA-384. All three are supported and none is broken for this purpose, but 384 is the convention across CDN documentation, so a hash you generate can be compared against a published one without conversion.
Can I use SRI with a URL that says latest?
No — that is the one combination guaranteed to break. The hash covers exact bytes, so the moment the URL resolves to a new version the check fails and your page loses the script. SRI only makes sense on a version-pinned URL.
Does SRI work on images and stylesheets?
Stylesheets yes, through the link element. Images no — the integrity attribute is only defined for script and link elements. It is also worth knowing that a failed check on a stylesheet leaves the page entirely unstyled, so test before deploying.
Is my file uploaded to generate the hash?
No. The hash is computed with the browser's own SubtleCrypto API in this tab. Nothing is transmitted, which also means you can hash an internal file you have not published yet.
