← SRI Checker & Hash Generator
SRI Checker & Hash Generator vs. checking tags by hand
Reading a page's source for SRI protection is a habit every developer already has -- open view-source or devtools, scan for integrity=. It reliably finds one failure and reliably misses the two that turn out to matter more: a crossorigin pairing gap, and a hash that has quietly gone stale. Both require a real fetch, not a read.
Check a page or generate a hash →
| What you're trying to find | Reading the source by hand | This checker's CLI |
|---|---|---|
A cross-origin tag with no integrity attribute at all. |
Works. This is the one gap that is visible directly in the markup. | Also finds it, plus the two below in the same pass. |
An integrity attribute with no matching crossorigin attribute -- which most browsers silently stop enforcing. |
Only catches it if you already know to check for the second attribute specifically and don't mistake its presence for enforcement. | Flags it explicitly, every time, with an explanation of why the pairing matters. |
| A declared hash that no longer matches what the CDN currently serves. | Cannot be determined from the source alone -- the tag looks identical whether the hash is current or stale. Requires re-fetching the asset. | Re-fetches every asset that declares a hash and compares it against what the CDN serves right now. |
| Auditing a page you did not write, with dozens of third-party tags. | Slow and easy to miss one, especially on a page you did not author yourself. | One command covers every cross-origin script and stylesheet tag on the page. |
| Running the same check automatically, before every deploy. | Not practical to repeat by hand on every change. | Exit-code gateable, so it can run in your own CI on every push. |
A manual read is still worth doing for a quick sanity check on one tag you just wrote. It stops being reliable the moment the question is "does this whole page's protection still hold" -- which is exactly the question the crossorigin pairing and the hash-drift check exist to answer, and neither is answerable from the HTML alone.
Common questions
What's wrong with just reading a page's view-source for SRI protection?
View-source finds the one failure that is visible in the markup itself -- a cross-origin script or stylesheet tag with no integrity attribute at all. It cannot find the other two failures this portfolio's own testing turned up as more common: an integrity attribute paired with no crossorigin attribute, and a declared hash that no longer matches what the CDN currently serves. Both require information the source alone does not contain.
Can I tell whether a crossorigin attribute is actually enforced just by looking at it?
No -- the attribute being present in the markup and the browser actually enforcing the pairing are two different facts, and reading the tag only confirms the first. Per the Fetch spec, integrity checking on a cross-origin request requires CORS mode, which the crossorigin attribute opts into; without it, most browsers silently skip the check rather than blocking the resource, so a tag with integrity alone looks identical in source to one that is actually protected. There is no visual difference to eyeball.
How would I know if a declared hash has gone stale, just by reading the tag?
You wouldn't -- the tag's integrity value is whatever was written when someone added it, and reading it tells you only what the page's author believed the file's hash was at that time. Whether that value still matches what the CDN serves today requires re-fetching the asset and re-hashing it, which is a network request a manual read of the HTML cannot perform. A hash that has drifted looks exactly like a correct one in the source.
Is this page making a live comparison against reading source code?
No. This is a static page describing a manual method every developer already has access to -- opening view-source or devtools and reading the tags by eye. It names no competing product or company. The checker's own CLI requests go straight from your machine to the page URL you name and the assets it references, never through this site.
Open the SRI Checker & Hash Generator, read why an integrity attribute with no crossorigin attribute leaves a page unprotected, or see how this compares to srihash.org's hash generator.