← SRI Checker & Hash Generator
SRI Checker & Hash Generator vs. srihash.org
Different shapes: srihash.org generates one integrity hash from one URL you already chose. This tool generates hashes locally from pasted content -- no URL or fetch required -- and its CLI additionally checks an existing page's cross-origin tags for missing integrity, missing crossorigin, or a hash that has drifted from what the CDN serves now.
Generate a hash or check a page →
srihash.org is a well-known, free, single-purpose SRI
hash generator: paste the URL of a script or stylesheet, and it fetches
that one resource and returns an integrity="sha384-..."
value plus a ready-to-paste tag. It solves exactly the step its name
describes -- turning one already-chosen URL into a hash -- and nothing
before or after that step.
This tool's hash generator does the same conversion, but from pasted
file contents rather than a URL, entirely in your browser with the Web
Crypto API and no fetch at all -- which also means it can hash a file
that has not been deployed to a public URL yet. Its companion CLI
(node cli/check.mjs <url> --json) does a different job
srihash.org has no mode for: it fetches a page itself, finds every
script and stylesheet tag loaded from a different origin, and reports a
tag with no integrity attribute at all, an
integrity attribute with no crossorigin attribute, or a
declared hash that no longer matches what the CDN
currently serves.
| What you are trying to do | Where to do it |
|---|---|
| Get the hash for one script or stylesheet URL you already know you want to hash. | Either — srihash.org fetches it by URL; this tool's generator hashes pasted content, useful when the file is not yet public. |
| Find out which cross-origin tags on a page you inherited are missing an integrity attribute entirely. | This checker's CLI — srihash.org has no page-crawling mode; you would need to already know which tags to look at. |
| Catch an integrity attribute that most browsers silently skip enforcing because it has no matching crossorigin attribute. | This checker's CLI — srihash.org's output is a single tag you paste in yourself, so it cannot audit one already on the page. |
| Know whether a hash written months ago still matches what the CDN serves today. | This checker's CLI — it re-fetches the asset and compares; srihash.org computes a hash once, for the URL you give it, with no notion of an existing declared value to compare against. |
| Run the same check unattended in your own CI before a page ships. | This checker's CLI, exit-code gateable — srihash.org is an interactive, one-URL-at-a-time web form. |
These compose rather than compete. A reasonable habit is this checker's CLI first, to find every cross-origin tag on a page and see which ones lack protection or have drifted, then either tool to (re)generate the hash for the specific file you are fixing.
Common questions
Should I use this tool or srihash.org?
They overlap on one thing -- turning a script or stylesheet into an integrity hash -- and differ in what happens before and after that step. srihash.org is a single-purpose generator: you paste the URL of a resource you have already decided to hash, it fetches that one resource, and it hands back the integrity value and a ready-to-paste tag. This tool's hash generator does the same job from pasted file contents rather than a URL, entirely in your browser, and it also ships a CLI that checks a page you did not write the tags for -- finding every cross-origin script and stylesheet tag, and flagging one with no integrity attribute at all, one with integrity but no crossorigin attribute, or one whose declared hash no longer matches what the CDN currently serves. Use srihash.org when you already know exactly which URL you want hashed. Use this tool's checker when you have inherited a page and need to know which of its cross-origin tags are missing that protection or have drifted out of date.
srihash.org is free too -- what does this add?
Being free is not the difference. srihash.org solves one step well: hand it a URL, get a hash. It has no mode for auditing an existing page's tags, so it cannot tell you that a tag is missing integrity entirely, that an integrity attribute is paired with no crossorigin attribute (which most browsers silently fail to enforce, so the tag looks protected and is not), or that a hash written months ago no longer matches what the CDN serves today. This tool's CLI does all three from one page fetch, exits non-zero on a finding so it can gate a CI run, and its hash generator works from pasted content -- useful for a file that has not been deployed to a public URL yet, which srihash.org's URL-based flow cannot hash at all.
Can srihash.org check an existing page for missing SRI protection?
No -- that is not what it does. srihash.org's job starts after you have already picked one script or stylesheet URL to hash; it has no crawl step and no report format for a whole page's tags. If you inherited a page with a third-party CDN tag and do not know whether it is protected at all, srihash.org gives you no way to find that out -- you would need to already know which tags to look at and hash each one by hand. This tool's CLI does that discovery step first: it fetches the page, finds every cross-origin script and stylesheet tag itself, and reports which ones are missing integrity, missing crossorigin, or hashed against a stale version of the file.
Is this page affiliated with srihash.org?
No. This site is not affiliated with, endorsed by, or sponsored by srihash.org or its operator. srihash.org is named here only to describe what it is and is not, as a well-known free SRI hash generator. What srihash.org currently does and how it works are described on its own site -- check there for what it covers today.
Open the SRI Checker & Hash Generator to hash your own file or check a page, or read why an integrity attribute with no crossorigin attribute leaves a page unprotected.