SRI hash generator

When your page loads a script or stylesheet from a CDN, you trust that the CDN serves exactly the file you expect. If the CDN is compromised or the file is altered, malicious code runs on your site. Subresource Integrity (SRI) prevents this: you add a cryptographic hash of the expected file to the tag, and the browser refuses to execute the file if its hash does not match.

How to use it

1. Paste the file contents, or provide the file.
2. Choose the algorithm; sha384 is the common choice.
3. Copy the generated integrity value and add it with crossorigin='anonymous' to your tag.

Example tag

<script src='https://cdn.example.com/[email protected]/lib.min.js'
        integrity='sha384-BASE64_DIGEST_HERE'
        crossorigin='anonymous'></script>

(Use double quotes in real HTML.) The integrity value is the algorithm name, a hyphen and the Base64-encoded digest of the exact file bytes.

Generating it on the command line

openssl dgst -sha384 -binary lib.min.js | openssl base64 -A

Rules to remember

• Pin exact versions. A URL that serves the latest version will change and break the hash. Use versioned URLs such as [email protected].
• crossorigin is required for cross-origin resources, and the CDN must send CORS headers.
• Any change breaks it, even a single byte or a different line ending, so hash the exact file served.
• You can list several hashes separated by spaces, for example during a migration.
• Combine with a Content-Security-Policy for stronger protection.