1. Keep crossorigin
The crossorigin="anonymous" attribute is what makes the integrity check
fail closed. Forgetting it silently turns SRI off for cross-origin files.
Audit tool
Generate SRI hashes for any external script.
Subresource Integrity (SRI) lets the browser verify that a third-party file has not been
tampered with before it runs. Paste a URL or the raw source, pick a hash algorithm, and
copy a ready-to-paste <script> or <link> tag with
the right integrity and crossorigin attributes.
Input
The browser fetches the file directly. CORS-restricted files will not be readable
here — switch to Source mode for those, or make sure the host
sends Access-Control-Allow-Origin.
Use this when the file is not publicly fetchable, or when you have already downloaded it locally and want to hash the exact bytes.
All three are valid SRI algorithms. SHA-384 is the W3C recommendation and the default in most CDNs.
The hash is identical for both — this just controls which HTML tag is rendered.
How to use the result
SRI is only valid if the bytes the browser downloads match the bytes you hashed.
1. Keep
2. Re-hash on every release
CDNs will roll out a new build at some point. Treat the hash as a release artifact and regenerate it whenever you bump the version in the URL.
3. Self-host when you can
SRI is great defense in depth. The stronger fix is to remove the cross-origin dependency entirely by hosting the file yourself.
Related reading
Where SRI fits into the broader security baseline.
Security headers best practices
How SRI complements the rest of the HTTP security baseline.
CSP Hash Generator
For inline <script> and <style> blocks that go into script-src / style-src.
CSP Generator
Build a full Content Security Policy that pairs well with SRI-protected scripts.
Headers Checker
Audit the response headers on a live URL — including any SRI tags that are missing or stale.
CSP Checker
Pull a real Content-Security-Policy header and explain every directive.
Allowing third-party scripts safely
The threat model SRI is designed to defend against, and what to do when the hash mismatches.