HTML Subresource Integrity Bundle Builder

How to use HTML Subresource Integrity Bundle Builder

Prepare one reviewable deployment bundle without manually copying resource hashes into tags. The tool matches direct external script and stylesheet references, hashes the original selected bytes with SHA-384, and changes only integrity attribute intervals. Your source is never loaded as a page or executed here.

1. Choose one original HTML file and the local JavaScript/stylesheet files it directly references. Enter their exact relative folder prefix. No project directory or URL is accessed.
2. Run to review the complete reference list, SHA-384 tokens, unused selected files and exact original integrity-attribute source intervals. Missing or ambiguous selected references refuse the whole operation.
3. Download the ZIP. It contains index.html, the original selected asset bytes at the mapped paths, integrity-manifest.json and a short deployment caution. Source outside the recorded attribute intervals remains unchanged.
4. Review every original file, deploy with HTTPS and test actual allowed and tampered resource responses. The tool does not publish files or certify your server, code, CSP or supply chain.

Good to know

• One nonempty strict UTF-8 HTML File, at most 100,000 bytes, with one optional initial BOM and original CRLF retained. Literal NUL, malformed Unicode, invalid UTF-8 and repeated initial BOM refuse. No supplied source is mounted, applied or executed.
• Choose 1–20 actual .js/.mjs/.css files, each 0–512 KiB and at most 4 MiB combined. Portable ASCII basenames are at most 100 characters and must be unique when compared without ASCII letter case; path separators, control characters and reserved Windows device stems refuse. References still match the exact original name spelling. Binary asset contents are hashed without decoding, newline changes or a validity/safety verdict.
• The prefix is empty or up to eight portable relative path segments, at most 80 characters, ending in slash. References may have one leading ./, then the literal prefix and one basename. HTML character references are decoded by parsing; one strict URI percent decode follows. Root/absolute URLs, traversal, separators in the remaining basename, whitespace, query and fragment refuse.
• Only direct HTML external scripts with omitted/empty type, text/javascript or module, and stylesheet link elements with omitted/empty type or text/css are selected. Legacy language attributes, base href, duplicate attributes, incomplete/self-closing script tags and unmatched references refuse. Inert template/foreign ancestry and other resource elements are explicit omissions.
• One same-origin module Worker imports the existing parser/ZIP writer before ready within 10 seconds; a separate 2-second computation deadline applies. Node/depth checks run after parsing the bounded 100,000-byte source; at most 20,000 nodes, 60 levels and 200 selected references are accepted. Combined local reads have a 5-second deadline. No background uploads, network requests or saved history are introduced.
• Only integrity attribute intervals are replaced or inserted. Other source, authored crossorigin/nonce/event handlers and active content are retained, not sanitized. The ZIP can contain untrusted or private original code; inspect it before opening or deploying. SHA-384 tokens do not prove code ownership or trustworthiness.
• The bundle copies all selected assets; unused selected files are listed with zero direct references. Transitive module/CSS imports, images, fonts, preload hints, runtime loads and other markup are not bundled or integrity-certified. HTTPS, exact served representation bytes, MIME, CORS, caching and existing CSP still require real deployment tests.
• Patched HTML is at most 160,000 UTF-8 bytes, complete evidence at most 200,000 characters/bytes, and the stored ZIP at most 5 MiB. Local file URLs are not an SRI enforcement test. A source-reference closure reparse is performed; this is not complete HTML validation or proof of browser behavior.