SRI hash generator

Generate the Subresource Integrity (SRI) hash for a script, stylesheet or any other file, ready to paste into an integrity attribute. Files are hashed locally in your browser and never uploaded. Each algorithm is its own QIP component: 7.99 kB for SHA-256, 9.71 kB for SHA-384 and 9.61 kB for SHA-512.

Copy integrity value Copy HTML

Paste text or choose a file (you can also drop one onto the text box). The text is hashed as UTF-8 exactly as typed, so a trailing newline changes the hash. For a file you serve, choose the file itself rather than pasting it.

Which algorithm? #

Browsers support SHA-256, SHA-384 and SHA-512 in the integrity attribute. SHA-384 is the common choice and what most CDNs publish. You can list more than one value separated by spaces, but browsers only check the strongest algorithm listed, so a single value is enough.

A cross-origin script or stylesheet also needs crossorigin="anonymous", and the server must send CORS headers, or the browser refuses to load it. The same values appear in npm, Yarn, pnpm and Bun lockfiles (as sha512-…), in Nix hashes and in the integrity field of import maps.

Download #

• bytes-to-sri-sha256.wasm — 7.99 kB
• bytes-to-sri-sha384.wasm — 9.71 kB
• bytes-to-sri-sha512.wasm — 9.61 kB

CLI equivalent #

npx @qip.dev/qipx qip.dev run bytes/bytes-to-sri-sha384.wasm < script.js

qipx downloads the component from qip.dev and saves it at bytes/bytes-to-sri-sha384.wasm. Each component reads up to 16 MiB of any bytes and writes the integrity value as text with no trailing newline, such as sha384-ywB1P0WjXou1oD1pmsZQBycsMqsO3tFjGotgWkP/W+2AhgcroefMI1i67KE0yCWn for abc. The digest uses standard padded Base64 (+, / and =), as SRI requires, not the URL-safe alphabet.