Your files stay on your device

# Subresource integrity hash

Hash a script or style into an integrity= attribute from text or a file, sha256/384/512, and inspect an existing attribute. The hash is computed locally; the file never uploads.
Paste textPick a fileScript / stylesheet textResource URL (optional)

Used only to build the ready-to-paste tag.
All three algorithms in one attributecrossorigin="anonymous"crossorigin="use-credentials"HashPasted tag to load (src + integrity prefill; regeneration input)

<script src=… integrity=…>, its src fills the URL field above.
integrity= valueInspect

- It cannot fetch the URL to verify the served bytes still match. Paste the actual file, or hash the served script yourself.
- integrity on same-origin files is pointless (you already control them); it protects third-party CDNs.
- crossorigin=anonymous is usually needed alongside integrity for CORS-fetched subresources.
Paste, drop, or type to begin. Everything stays on this device.

## More web & auth tools

- [Hash generator](/crypto/hash)
- [CSP evaluator & builder](/web/csp)
[All web & auth tools](/web)

---

Canonical HTML: https://nutter.tools/web/sri/
Markdown version: https://nutter.tools/web/sri/index.md
Plain-text version: https://nutter.tools/web/sri/index.txt
Agent index: https://nutter.tools/llms.txt