How to use Subresource integrity generator
Create a SHA-256, SHA-384 or SHA-512 integrity token from a local JavaScript or CSS file. The check runs when you submit the form. Its inputs are processed in this browser.
How the check works
The selected file is read locally and hashed with the chosen Web Crypto digest. The digest is Base64 encoded and prefixed with the algorithm name for the integrity attribute.
The Overview tab explains the findings. Measured data lets you search individual fields and values, while JSON report shows the complete export. Export JSON to retain a baseline, or print the findings for your own records. Review the report before sharing it: browser characteristics, token claims, and file names can reveal information about your setup.
Read the result in context
Use the exact bytes that the browser will receive. Rebuilding, changing line endings or modifying the asset changes its integrity token.
Understand the limits
Cross-origin resources also need suitable CORS responses. An integrity token verifies expected bytes; it does not establish that the code is harmless.
Common questions
Where is the input processed?
In this browser tab. This tool does not submit its input to the site server or a third-party service.
What should I keep with a result?
Record the selected options, browser and time. Review exported values before sharing them. Generated passwords, tokens and HMAC secret keys are excluded from report exports.