Free local web-security utility
Pin the bytes you trust.
Select a script or stylesheet from your device. This tool creates copyable Subresource Integrity metadata without uploading the file anywhere.
1 · Select a file
Start with the exact bytes you will serve.
Choose a local file to calculate its hashes.
The file stays in this browser. A later file change—even one byte—needs a new hash.
2 · Copy integrity metadata
Your SRI values will appear here.
Waiting for a local file…Waiting for a local file…Waiting for a local file…Optional HTML starting points
One hash, two common tags.
The snippets use SHA-512 because it is the strongest displayed algorithm. Replace the example URL with the URL that serves the identical file.
Use it carefully
A byte check, not a full security review.
Subresource Integrity lets a browser compare a fetched resource with a cryptographic digest before using it. The current SRI specification recognizes `sha256`, `sha384`, and `sha512`; this tool provides all three for the selected local file.
For an external resource, the server must make the bytes available to the browser’s CORS request. Verify the final deployed URL and test your page before relying on SRI. This tool does not fetch a URL, check CORS, modify a website, scan dependencies, protect inline code, or guarantee protection from every supply-chain or web-security risk.
Read the W3C Subresource Integrity specification ↗
Read MDN’s SRI guidance ↗