File Hash & SRI Generator
Hash the bytes of a local file and export an exact checksum or Subresource Integrity value.
Select actual file bytes
No file selected.
The complete file is read in memory locally, with a 20 MiB limit and a 15-second timeout. A URL or filename is never fetched or treated as the file's contents.
Choose a local file. No file has been read yet.
Digest and integrity value
No digest calculated.
Compare this digest with a trusted expected value. It does not assess malware, authorship, or whether a trusted source supplied the expected value.
Hash a local file and create its SRI value
This tool reads a selected file's actual bytes and computes SHA-256, SHA-384, or SHA-512 with Web Crypto. It provides the same digest in hexadecimal, Base64, and a matching Subresource Integrity string. The full JSON report adds the displayed filename and exact byte count.
How to hash and export
- Select a local file up to 20 MiB. Empty files are supported.
- Choose an algorithm and select Hash file. The worker reads and hashes the file locally.
- Switch between SRI, hex, Base64, and JSON without rehashing. Copy or download matches the visible output exactly.
- Changing the file or algorithm clears the old digest. Cancel stops the worker and discards its result. Reset also clears the selected file.
Use SRI with the matching resource
An SRI value uses an algorithm prefix followed by the Base64 digest, such
as sha384-.... Put the result in the integrity attribute of
the matching supported script or stylesheet resource. The served resource
must have the same content bytes; editing or rebuilding it requires a new
value. This tool does not fetch a URL or confirm what a server currently
returns.
Cross-origin SRI requests require the resource server's CORS permission; a
typical script or stylesheet link also uses crossorigin="anonymous". Check the browser and server
behavior for your actual resource. A correct hash alone does not make a
malicious file safe.
Memory, cancellation, and failure states
Web Crypto digest does not accept a stream, so the entire file and browser working copies can occupy memory. The smaller 20 MiB limit is this tool's practical cap, not a SHA algorithm limit. A 15-second watchdog bounds the UI job. Cancelling terminates the worker and prevents its result from appearing; the browser controls any underlying native cleanup.
Web Crypto requires a supported secure context, normally HTTPS or localhost. Unsupported hashing, worker creation failure, file read failure, oversize input, or timeout clears the output and reports an error. Filenames are displayed as text and are not executed, interpreted as URLs, or used as export filenames.
Known example and references
Load abc example creates a local three-byte UTF-8 file containing exactly abc, without a newline. This provides a repeatable check
against independent SHA references. See
SubtleCrypto.digest
and
Subresource Integrity
for the browser API, resource matching, and CORS requirements.