---
title: "Free SRI Hash Generator - SHA-256/384/512 | CentralCSP"
description: "Generate a Subresource Integrity hash for any script or stylesheet URL: SHA-256, 384 or 512, a ready-to-paste tag, and a CORS check so SRI will actually work."
url: "https://next.centralcsp.com/en/tools/sri-hash/"
lang: "en"
---

SRI Tool

# SRI hash calculator

Paste a script or stylesheet URL and get its Subresource Integrity hash to pin the exact file in your HTML.

Script or stylesheet URL [Learn how SRI works](https://next.centralcsp.com/en/docs/web-security/other/subresource-integrity)

256 384 512

Calculate SRI hash

Need a hash for your own inline script or style? [Use the CSP hash calculator](https://next.centralcsp.com/en/tools/csp-hash/)

Guide

## Understanding Subresource Integrity

Subresource Integrity (SRI) is the integrity attribute you add to a script or stylesheet loaded from another host, so the browser rejects the file if a CDN ever serves tampered code.

### What is an SRI hash?

An SRI hash is a base64-encoded SHA digest of the exact bytes of a file. You put it in the integrity attribute of a script or link tag; the browser hashes what it downloads, compares, and refuses the resource on any mismatch, treating it as a network error.

It defends against one specific threat: a third-party host or CDN that serves you tampered or compromised code. Because the value is tied to the exact file, an attacker who swaps the asset cannot make the browser run it. Read the full explanation in the [Subresource Integrity guide](https://next.centralcsp.com/en/docs/web-security/other/subresource-integrity).

```
<script
  src="https://cdn.example.com/app.min.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
  crossorigin="anonymous"></script>
```

### Add the crossorigin attribute

For a file on another origin, add crossorigin="anonymous" next to integrity. A browser only verifies a cross-origin resource when the host allows the read with CORS, an Access-Control-Allow-Origin header. Without it the browser cannot check the file and ignores the integrity attribute, which is why this tool warns you when a URL is not CORS-readable.

```
<link
  rel="stylesheet"
  href="https://cdn.example.com/theme.css"
  integrity="sha384-VuArbKap7CY5uykM6oqf+R9GqQ8Kux9rx7HNQlGYl1kPzQho1wx4JwY8wCdgcRRap"
  crossorigin="anonymous">
```

### Requiring SRI across your site

SRI is opt-in: you add a hash tag by tag. The old CSP require-sri-for directive would have forced it site-wide, but it never shipped to a stable browser and is abandoned.

To require integrity across your whole site today, use the Integrity-Policy header: the browser blocks, or reports, any script loaded without valid SRI, turning a per-tag opt-in into an enforceable policy. Both are covered in the [Integrity-Policy guide](https://next.centralcsp.com/en/docs/web-security/policies/integrity-policy).

```
Integrity-Policy: blocked-destinations=(script)
```

### SHA-256, SHA-384, or SHA-512?

SRI accepts the same three algorithms as CSP. SHA-384 is the most common choice for SRI, but all three are equally safe here, so pick one and apply it consistently. You can even list several hashes on one tag: the browser accepts the file if the strongest algorithm it understands matches.

Keep reading

-   [Subresource Integrity](https://next.centralcsp.com/en/docs/web-security/other/subresource-integrity)
-   [The Integrity-Policy header](https://next.centralcsp.com/en/docs/web-security/policies/integrity-policy)
-   [The require-sri-for directive (deprecated)](https://next.centralcsp.com/en/docs/web-security/policies/content-security-policy/directives/require-sri-for)
-   [Monitor Integrity-Policy reports](https://next.centralcsp.com/en/docs/platform/monitoring/integrity-policy)

## Track integrity on every page

An SRI hash pins one file, CentralCSP watches them all. Deploy an Integrity-Policy in report-only and catch a swapped third-party script the moment it changes, in your real visitors' browsers.

[Start with CentralCSP](https://app.next.centralcsp.com) [Book a demo](https://next.centralcsp.com/en/contact/?topic=demo)

---

Available in: [en](https://next.centralcsp.com/en/tools/sri-hash/), [fr](https://next.centralcsp.com/fr/tools/sri-hash/)