Subresource Integrity Hash
Computes the Subresource Integrity attribute (sha256/384/512) for a script or stylesheet you paste or drop in.
A `<script src>` pointing at a CDN is a standing permission for that CDN to run any code it likes in your users’ browsers. A Subresource Integrity attribute revokes it: the browser refuses to execute a file whose hash does not match the one you pinned.
Drop the exact file
The script or stylesheet you will serve. It is hashed as-is.
Hashed with WebCrypto in your browser — the same digest the browser will check against. There is no URL box on purpose: fetching a remote file from this page to hash it would either be blocked by CORS or become an SSRF vector, and a browser cannot resolve-then-pin a host the way a server can. Paste the file you are serving.
How to use it
Give it the file or the URL
Drop the exact file you will ship, or fetch a URL. The hash is over the bytes, so a file and a URL that differ by a newline give different attributes.
Copy the whole attribute
The output is `integrity="sha384-…"`. Paste it onto the tag along with `crossorigin="anonymous"` — without that, a cross-origin resource is opaque and integrity cannot be checked.
Pin a version, not a moving tag
An integrity attribute against a `@latest` URL breaks the site the day the CDN publishes. Point at an exact version and update both together.
Common questions
Which algorithm should I use?
sha384 is the usual choice and what most CDNs publish. sha256 is accepted and sha512 is stronger, but the difference is not the weak point in this design — pinning the wrong version is.
The script stopped loading after I added it.
Almost always one of three things: the file changed on the CDN, `crossorigin="anonymous"` is missing, or the hash was taken from a different build than the one being served (a minified versus unminified file, for instance).
Does SRI protect against a compromised script that was always hostile?
No. It guarantees you get the bytes you pinned, nothing more. If the version you pinned was already backdoored, SRI faithfully delivers the backdoor every time.
Feed it from
File Checksum
Hashes files of any size in a streaming pass and compares the result against a pasted expected value.
CSP Builder
Builds a Content-Security-Policy from a guided form or from a report, and explains each directive.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Passphrase Generator
Builds a diceware-style passphrase from a word list, showing the entropy in bits.
Next
These accept what this tool produces, so the result can go straight in.
CSP Builder
Builds a Content-Security-Policy from a guided form or from a report, and explains each directive.
File Checksum
Hashes files of any size in a streaming pass and compares the result against a pasted expected value.
Security Header Scan
Grades a site’s HSTS, CSP, frame, referrer and permissions headers and shows what to add.
Suspicious URL Check
Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
Breach Check
Checks whether a password appears in Have I Been Pwned’s breach data, sending only the first five characters of its SHA-1 hash from the browser (k-anonymity).