How to use it
- Paste the text of the script or stylesheet into Text of the file, or pick the file under Or a file.
- Choose the Algorithm. Use All three to write one value for each algorithm.
- Type the Address of the file exactly as the page will load it. The element to paste appears below.
- Copy the Integrity value or the Element to paste into your page. To check a value you have, paste it under Integrity value to check.
How the value is made
The integrity value is the name of a hash algorithm, a dash and the digest of the file in base64. The browser hashes the exact bytes of the file, so the value changes if one byte changes. Every conforming browser supports sha256, sha384 and sha512 (SRI section 3.2). Base64 uses the alphabet of RFC 4648 with the = sign at the end for padding (section 4).
A value with several items, separated by spaces, is allowed (section 3.2.1). The browser uses the strongest algorithm among the items it knows, so sha512 decides over sha256.
integrity = algorithm + "-" + base64(digest(bytes))- sha256: 44 characters of base64 after the dash.
- sha384: 64 characters after the dash.
- sha512: 88 characters after the dash.
What the check does and what it does not cover
A check passes when the bytes of the file give one of the values of the strongest algorithm in the attribute (SRI section 3.3). An item with an algorithm the browser does not know is skipped. When no item is left, the check passes without comparing anything, so this tool reports that case as unchecked.
The value says nothing about where the file came from. It proves that the file has the bytes that were hashed. Make the value again each time the file changes, for example after a library update, and keep the value in the same place as the element.
The text abc
The text abc is the three bytes 61 62 63 in UTF-8. Choose sha256 and type abc in the text box. The integrity value for the text is the one in the table, and the element to paste carries it with crossorigin set to anonymous.
| Algorithm | Integrity value for abc |
|---|---|
| sha256 | sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0= |
| sha384 | sha384-ywB1P0WjXou1oD1pmsZQBycsMqsO3tFjGotgWkP/W+2AhgcroefMI1i67KE0yCWn |
Frequently asked questions
Do I have to change the value when the file changes?
Yes. The value is for one exact sequence of bytes, so an update of the library, even one changed space, gives a different value. The check then fails until the attribute holds the new value.
Which algorithm should I choose?
Every browser supports all three (SRI section 3.2). sha384 is a stronger digest than sha256 and a shorter value than sha512. Choose All three to write a value for each one, and the browser will check the strongest.
Why does the value have an algorithm name and a dash?
The name tells the browser which digest to compute. The dash ends the name, because the names have no dash, while the base64 value may contain dashes in its URL-safe alphabet, as SRI section 3.5 allows.
Does the tool send my file to a server?
No. Your browser reads the file and hashes it with the digest method of the browser (crypto.subtle). The page makes no network request and stores nothing you type or pick.
Why does the element to paste contain crossorigin?
SRI requires CORS for a resource on another origin (section 5.3), and crossorigin set to anonymous asks the browser to use CORS. The element includes it for both scripts and stylesheets.
Sources
- W3C, Subresource Integrity (Working Draft, 20 March 2026): sections 3.2, 3.3, 3.5 and 5.3
- RFC 4648, The Base16, Base32, and Base64 Data Encodings, section 4
- MDN, SubtleCrypto.digest()
Figures and text last checked on Tuesday, November 10, 2026.