SRI Hash for Bootstrap CDN

Bootstrap SRI Hashes for Secure Loading

Bootstrap is the world's most popular CSS framework, and its official documentation has always included SRI hashes in its CDN installation instructions. Both the CSS stylesheet and the JavaScript bundle require separate integrity attributes.

Bootstrap 5.3 with SRI

Bootstrap requires two resources — CSS and JS — each with its own integrity hash:

<!-- Bootstrap CSS -->
<link
  href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css"
  rel="stylesheet"
  integrity="sha384-QWTKZyjpPEjISv5WaRU9OFeRpok6YcnS..."
  crossorigin="anonymous"
/>

<!-- Bootstrap JS Bundle (includes Popper) -->
<script
  src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"
  integrity="sha384-YvpcrYf0tY3lHB60NNkmXc5s9fDVZLESaAA..."
  crossorigin="anonymous"
></script>

Why Bootstrap Emphasizes SRI

Bootstrap is loaded on an estimated 20%+ of all websites. A compromised Bootstrap CDN file could affect hundreds of millions of users. The Bootstrap team has championed SRI since its introduction, and every official "Getting Started" guide includes integrity attributes.

Separate Hashes for Each File

A common mistake is using a single SRI hash for both the CSS and JS files. Each file has unique content and therefore requires its own hash. When upgrading Bootstrap, you must update both hashes.

Bootstrap Components and SRI

If you load individual Bootstrap components instead of the full bundle, each component needs its own SRI hash:

• bootstrap.min.css — full CSS
• bootstrap.bundle.min.js — JS with Popper
• bootstrap.min.js — JS without Popper (requires separate Popper SRI)
• bootstrap-grid.min.css — grid-only CSS
• bootstrap-utilities.min.css — utilities-only CSS

Verifying Bootstrap Hashes

1. Visit the Bootstrap download page to find official hashes
2. Cross-reference with jsDelivr or cdnjs published hashes
3. Download the file and compute the hash locally
4. Use this SRI generator tool to paste the file content and confirm

Upgrade Workflow

When upgrading Bootstrap versions:

1. Update the version number in the CDN URL
2. Download the new files
3. Generate new SRI hashes for each file
4. Update both integrity attributes in your HTML
5. Test in staging before deploying to production