v135 · security

Key Manager

Generate an Ed25519 or ECDSA key pair in-browser, sign a JavaScript resource, and produce the integrity="ed25519-…" attribute value. Demonstrates the full workflow a CDN operator would automate: keygen → sign → deploy the public key in a Link header → verify on load.

checking WebCrypto… checking Ed25519…
Signature-based SRI replaces the hash-in-HTML pattern with a public-key-in-header pattern. The CDN signs each resource with its private key. The browser verifies the signature using the public key from the Link: <key.jwk>; rel="integrity-manifest" header. This means you don't need to update HTML when files are cache-busted.
1
Generate key pair

Create an Ed25519 key pair. The private key signs resources; the public key goes in your Link header.

2
Sign your resource content

Paste the JS/CSS content and sign it with the private key.

3
Add integrity attribute

Use the base64url-encoded signature as the integrity="ed25519-…" attribute on the <script> tag.

4
Tamper test

Modify the content and verify again — signature should fail.

2. Resource content to sign

Generated integrity attribute

Generate a key pair first.

Deployment headers

Sign a resource to see the headers.