A correct Subresource Integrity (SRI) hash can still fail if it was calculated from different bytes than the browser fetched, or if the integrity attribute includes a stronger but incorrect hash. SRI verifies the fetched resource’s bytes—not whether the source file looks the same—and when several hash algorithms are listed, the browser checks the strongest one present.
What SRI checks when a script loads
Subresource Integrity lets a browser verify that a fetched resource matches an expected cryptographic digest before using it. The browser calculates a digest from the response bytes, encodes it in Base64, and compares it with the value in the integrity attribute. The comparison is case-sensitive. If the applicable digest does not match, the resource fails integrity verification and the script does not execute. The W3C Subresource Integrity specification describes the mechanism as one that lets user agents verify that a fetched resource arrived without unexpected manipulation.
As an Amazon Associate I earn from qualifying purchases.
Why line endings can make a correct hash fail
A digest covers bytes, not the visual appearance of a file. A line feed (LF) is the byte 0A; a carriage return plus line feed (CRLF) is 0D 0A. Those sequences can look like the same line break in an editor, but they produce different input bytes and therefore different digests.
Free tools Windows power users keep installed
One-click scans. No signup required.
A hash generated from a checked-out source file proves that the local bytes match that digest. It does not prove that the deployed response is byte-for-byte identical. A checkout setting, build process, deployment pipeline, proxy, or server transformation may change the file. Other differences to check include a final newline, a byte-order mark, minification, bundling, injected banners, content transformations, or an asset version that changed after the hash was generated. These are possible byte-level causes, not evidence that a particular browser normalizes line endings.
Hash the response the browser actually receives
In the browser’s Network panel, identify the final resource URL and inspect the response body, taking redirects and caching into account. Capture those response bytes without passing them through a text editor that might normalize line endings, then calculate the digest using the algorithm in the relevant integrity entry. Compare its Base64 value character-for-character with the attribute.
#1 Best Overall
Why a weaker matching hash may not help
If an integrity attribute contains more than one hash algorithm, the browser selects the strongest algorithm represented in the metadata. The specified order is SHA-256, then SHA-384, then SHA-512, from weaker to stronger. The SRI Level 2 Working Draft dated March 20, 2026 is a draft, not a finalized Recommendation.
For example:
<script src="/app.js"
integrity="sha384-CORRECT_DIGEST sha512-STALE_OR_INCORRECT_DIGEST"></script>Here, SHA-512 is the strongest listed algorithm, so a matching SHA-384 entry does not rescue an incorrect SHA-512 entry. If the metadata contains several entries for the strongest algorithm, a match against any one of them can satisfy the check. When adding a stronger algorithm, make sure its digest is current: adding a stale stronger value changes which entries the browser validates.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteA troubleshooting sequence for an SRI failure
- Check the actual request. In the browser’s Network panel, find the script request, final URL, redirects, cache status, and response body.
- Calculate from the response bytes. Capture the served body without text-editor conversion and calculate the digest for the algorithm you are checking.
- Compare the full value. Check the Base64 digest character-for-character; SRI matching is case-sensitive.
- Inspect every algorithm in the attribute. Identify the strongest listed algorithm and verify the entries at that level. A correct weaker entry cannot compensate for an incorrect stronger one.
- Check for a different load failure. Review the console and Network panel for CORS, Content Security Policy (CSP), URL, version, or other errors. These can accompany or be mistaken for an SRI failure, but the error message and request details determine what happened in a particular case.
- For a cross-origin script, verify CORS. SRI-protected cross-origin resources require a response that passes CORS. Also serve the page in a secure context; the specification warns that integrity metadata delivered in an insecure context could be altered by a network attacker.
How to distinguish the likely causes
| What you observe | What to check |
|---|---|
| The hash matches a local file, but the response digest differs | The deployed response has different bytes. Compare line endings and build, deployment, or server transformations. |
| A weaker entry matches, but a stronger entry is also listed | Recalculate the entries for the strongest listed algorithm or remove stale metadata. |
| The response digest matches, but the request still fails | Inspect the console and Network panel for CORS, CSP, an incorrect URL, or another loading problem. |
| The script is hosted on another origin | Confirm that the cross-origin response passes CORS and that the page uses a secure context. |
What the standard establishes—and what it does not
The specification establishes byte-based verification, strongest-algorithm selection, and the CORS requirement for SRI-protected cross-origin resources. A line-ending mismatch follows from the fact that LF and CRLF are different byte sequences; it is not a claim that browsers silently normalize one into the other. The cause of an individual failure still depends on its response, metadata, and browser diagnostics.
Quick Recap
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
