SRI Hash Generator (SHA-256 / 384 / 512)
Protect your web application against compromised third-party CDNs and supply-chain injection (Magecart). Compute W3C Subresource Integrity cryptographic digests in-browser.
<!-- W3C Subresource Integrity (SRI) Protected Script --> <script src="https://cdn.example.com/lib/sdk.min.js" integrity="" crossorigin="anonymous" ></script> <!-- All Computed Cryptographic Hashes --> <!-- SHA-256: --> <!-- SHA-384: --> <!-- SHA-512: -->
Mitigating Supply-Chain Compromises with Cryptographic Pinning
When loading JavaScript libraries or stylesheets from external Content Delivery Networks (CDNs), an attacker who compromises the CDN bucket can inject credit-card skimmers (Magecart) across thousands of sites simultaneously. Subresource Integrity (SRI) instructs browsers to verify the exact cryptographic hash of the downloaded byte stream before executing a single line of code.
Why SHA-384 Is Recommended
The W3C specification recommends sha384 over sha256 because SHA-384 is immune to length-extension attacks while being truncated from the 64-bit word operations of SHA-512, running faster on modern 64-bit CPU architectures.
Mandatory crossorigin="anonymous"
Browsers will refuse to validate cross-origin SRI hashes unless the crossorigin="anonymous" attribute is present on the tag and the remote CDN responds with an Access-Control-Allow-Origin: * header.
PCI-DSS 4.0 Requirement 6.4.3
Under PCI-DSS v4.0 Requirement 6.4.3, e-commerce payment pages must implement a mechanism to assure the integrity of every script loaded in the consumer's browser, making SRI a mandatory compliance control.