Compute the integrity attribute for a CDN file, entirely in your browser
SRI lets the browser check that a JavaScript or CSS file loaded from a CDN has not been swapped out at the source. You put the file's hash in the integrity attribute; the browser hashes what it downloaded and refuses to run or apply the file if the two do not match. It is defined by the W3C Subresource Integrity specification and works on script and link rel="stylesheet".
The value looks like algorithm-base64. After the hyphen comes the raw hash bytes encoded in Base64, not hex, so pasting the output of a typical hash tool will not work. This tool computes the digest with the browser's WebCrypto API and gives you the Base64 form directly.
For a resource served from another origin, SRI needs crossorigin="anonymous". Without it the browser treats the response as opaque and cannot read the bytes to verify them. The generated tag includes the attribute. If the CDN does not send CORS headers, SRI cannot be used at all.
You may list several values separated by spaces. The specification says the browser picks the strongest algorithm it understands and verifies with that one only. So listing sha256 and sha512 does not mean both are checked; sha512 is used. It is meant for transition periods where older browsers need a fallback value.
| Algorithm | Base64 length | When to use |
|---|---|---|
| sha256 | 44 chars | Maximum compatibility, but sha384 or stronger is the current advice |
| sha384 | 64 chars | The practical default; most CDN docs show this |
| sha512 | 88 chars | Strongest, at the cost of a longer value |
All hashing happens in your browser through WebCrypto. The file or text you choose is never sent to a server. WebCrypto may be unavailable when the page is opened from a local file:// URL.
The Subresource Integrity specification requires Base64. The raw hash bytes are Base64 encoded and prefixed with the algorithm name and a hyphen. Pasting the hex output of a typical hash tool will not validate.
You need it for resources loaded from another origin. Without it the browser cannot read the response body and therefore cannot verify the hash. Same-origin files do not need it.
The browser verifies with the strongest algorithm it understands and ignores the rest. It does not require both to match. Listing several is meant for transition periods.
No. Hashing is done entirely with the browser WebCrypto API. Neither the chosen file nor the pasted text is sent to a server.