Add an integrity hash to a third-party script tag

CDN scripts can change underneath you. An SRI hash makes the browser refuse a tampered file — here is how to generate one.

Tools used in this guide

SRI hash generator
Hash calculator
CSP header builder

The job

Subresource Integrity pins a <script src> or <link> to exact bytes: if the CDN serves anything else, the browser blocks it. You need the sha384/512 base64 digest of the exact file the CDN serves.

Hash the real bytes

Drop the actual file (not a re-saved copy — line endings and compression matter) or paste the exact response body. Pick sha384 or sha512, copy the integrity value, and add it with crossorigin="anonymous" to the tag.

integrity="sha384-…" — the algorithm prefix is part of the value.
The tag preview is generic; merge the attribute into your real markup.

When it breaks

A hash mismatch means blocked — including when the CDN ships a legitimate update. Version-pin the URL (react@18.2.0, not @latest) so the bytes stay stable, and re-hash on every intentional upgrade.