Signature-based resource integrityLimited availability
Signature-based resource integrity verifies a script's provenance by checking that the resource has been signed with a trusted key given by the <script> element's integrity attribute.
Not yet supported in all major browsers — check the table and provide a fallback.
Browser support
DesktopChrome
1–140Not supported
141+Supportedsince Sep 30, 2025
Current: 155Edge
12–140Not supported
141+Supportedsince Oct 3, 2025
Current: 154Firefox
✕Not supportedup to 157
Current: 157Safari
✕Not supportedup to 27
Current: 27MobileChrome Android
18–140Not supported
141+Supportedsince Sep 30, 2025
Current: 155Firefox Android
✕Not supportedup to 157
Current: 157Safari iOS
✕Not supportedup to 27
Current: 27How to use
Not supported in Firefox, Safari, Firefox Android, Safari iOS. Use feature detection below and provide a fallback (or a polyfill) for those browsers.
Example
Full syntax and examples are on MDN — see the links below.
Feature detection
JS · check before using
if ("integrity" in document.createElement("script")) {
// the integrity attribute/property of <script> is supported
}Specification
Sub-features
Support for each part of the feature (4). The overall table above shows when the whole feature works.
| Sub-feature | Chrome | Edge | Firefox | Safari | Chrome Android | Firefox Android | Safari iOS |
|---|---|---|---|---|---|---|---|
| script.integrity.ed25519_public_key | 141 | 141 | ✕ | ✕ | 141 | ✕ | ✕ |
| http.headers.Signature | 141 | 141 | ✕ | ✕ | 141 | ✕ | ✕ |
| http.headers.Signature-Input | 141 | 141 | ✕ | ✕ | 141 | ✕ | ✕ |
| http.headers.Unencoded-Digest | 141 | 141 | ✕ | ✕ | 141 | ✕ | ✕ |