Generate Subresource Integrity digests from the exact bytes of a script, stylesheet, or other text resource. Select SHA-256, SHA-384, SHA-512, or all three, and the page uses the browser Web Crypto implementation to produce standards-compatible base64 integrity tokens. Byte counts and digest lengths are shown alongside the output. Hash the deployed file bytes, including whitespace and line endings, because any change produces a different token.
UTF-8 encodes the supplied text, computes the selected SHA-2 digest with crypto.subtle.digest, and formats it as algorithm-base64.
SRI proves fetched bytes match the token. It does not establish that the original code is trustworthy.
console.log("Loaded with integrity checking");sha384-BASE64_DIGEST
The text box is encoded as UTF-8. Uploaded text files are decoded by the browser before hashing, so use a byte-preserving workflow for non-UTF-8 or binary assets.
This page cannot fetch a remote CDN URL. Paste the exact resource or upload a text file; binary assets are outside the text input workflow.
The checker reports this directly from the supplied resource content and shows the relevant value in its output.
Use the result together with the browser and server behavior you support; the page does not make remote requests.
Review the generated finding before deployment, especially when proxies or CDNs can alter headers.
The implemented rule follows current HTTP security-header practice and flags values it cannot recognize.
Retest with the exact production response because small header changes can affect the conclusion.
| Stage | What is reported |
|---|---|
| Parse | Recognized input fields and values |
| Validate | Invalid, missing, or conflicting settings |
| Export | Text, CSV, and JSON when structured data is available |
Browse more tools for HTTP behavior, browser policies, cookies, CORS, CSP, and response-header security.
View HTTP & Security Headers