Generate the integrity attribute for a <script> or <link> tag, so the browser refuses to run a CDN-hosted file if it's ever silently modified. Paste a URL to fetch, or drop a local file - nothing is uploaded anywhere.
Click or drop a file here
How it works
Both the URL and file modes hash the exact bytes fetched or uploaded using the Web Crypto API's crypto.subtle.digest() with SHA-384, base64-encode the result, and prefix it with sha384- to produce the integrity attribute value — the same value a browser recomputes and checks before it will execute a fetched script or stylesheet.
FAQ
Why does it always use SHA-384 instead of SHA-256 or SHA-512?
SHA-384 is the algorithm most CDN documentation (including jsDelivr's and cdnjs's own examples) defaults to for SRI hashes — a good balance of security and attribute length — though SHA-256 and SHA-512 are equally valid per the spec.
Why did fetching a URL fail with what looks like a CORS error?
The browser can only hash bytes it's actually allowed to read — if the server hosting that file doesn't send permissive CORS headers, the fetch is blocked entirely; downloading the file and using the 'From file' tab instead works around that.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.