Your files stay on your device

Subresource integrity hash

Hash a script or style into an integrity= attribute from text or a file, sha256/384/512, and inspect an existing attribute. The hash is computed locally; the file never uploads.

Content to hash

Used only to build the ready-to-paste tag.

<script src=… integrity=…>, its src fills the URL field above.

SRI registers sha256, sha384, sha512 only (W3C SRI §2.3.2)
Inspect an existing attribute (optional)
What this tool does not do
  • It cannot fetch the URL to verify the served bytes still match. Paste the actual file, or hash the served script yourself.
  • integrity on same-origin files is pointless (you already control them); it protects third-party CDNs.
  • crossorigin=anonymous is usually needed alongside integrity for CORS-fetched subresources.
Paste, drop, or type to begin. Everything stays on this device.