---
id: "sri_hash"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["cryptography", "internet"]
langs: ["common"]
quality: 75
url: "http://registry.apicrafter.io/datatype/sri_hash"
---

# Subresource Integrity (SRI) hash (`sri_hash`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Integrity metadata of W3C Subresource Integrity, as written in the integrity attribute of HTML script and link elements: the hash algorithm (sha256, sha384 or sha512), a hyphen and the Base64 digest of the resource. An integrity attribute may hold several such values separated by spaces; the regexp matches one.

- Personal data (PII): no
- Categories: Cryptographic identifiers (cryptography), Internet (internet)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^(?:sha256-[A-Za-z0-9+/]{43}=|sha384-[A-Za-z0-9+/]{64}|sha512-[A-Za-z0-9+/]{86}==)$
```

## Examples

- `sha384-H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO` — Example of the W3C specification: digest of the script alert('Hello, world.');
- `sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng=` — SHA-256 integrity value of the same script
- `sha256:5b0bcabd1ed22e9fb1310cf6c2dec7cdef19f0ad69efa1f392e94a4333501270` (invalid example) — OCI content digest (hexadecimal, colon)

## Sources

- doc: <https://www.w3.org/TR/sri/>
- other: <https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity>
- wikipedia: <https://en.wikipedia.org/wiki/Subresource_Integrity>

## Quality

Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage.

JSON: <http://registry.apicrafter.io/api/v1/datatypes/sri_hash.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/cryptography/sri_hash.yaml>