SRI check: Which scripts on your page could be swapped without the browser noticing?
Paste a page address. We read its HTML and list every script and stylesheet it loads, whether each carries an integrity hash, whether that hash still matches the file served today, and the integrity attribute to paste for the ones without. Files that change under the same URL (tag managers, Stripe.js, Google Fonts) are named, because a hash there breaks the page.
What it does
- Every <script src>, stylesheet and modulepreload in the page's HTML, other origins first
- integrity present, matching the file served now, or already blocking it
- Catches the two quiet failures: no crossorigin attribute, and a CDN that sends no Access-Control-Allow-Origin
- integrity="sha384-…" crossorigin="anonymous" ready to paste, one per file
- Names URLs that change without a new address, so you self-host those or watch them with CSP reports
- Shareable result link
What goes in, what comes out
- What goes in
- The public address of a page (a checkout, a sign-in page, your home page).
- What comes out
- Each script and stylesheet the HTML loads: same or other origin, integrity state (none, match, mismatch), CORS problems that make the browser block it, a note when the URL can change, and the sha384 integrity attribute.
- Example
- osec.one's own home page on 25 October 2026: 3 files, 1 from another origin (Google Fonts CSS, no integrity, and flagged as one that can't be pinned because Google builds it per browser).
- Limits
- Only tags in the HTML; scripts loaded by other scripts at run time aren't seen. Up to 25 files of 1.5 MB each. 20 checks a day per IP address without an account. A matching hash says the file is the one you pinned, not that it is safe; if the HTML is stored with the files, someone who can change one can change both.