Calculate the SRI hash for custom domains on the SRI page

_docs/20_install-script/19_sri.md

@@ -1,10 +1,11 @@
 ---
 title: SRI version
 category: install-script
+skip_pjax: true
 permalink: /sri
 sriVersion: 12
 sriHash: sha256-iSFbgQEAJgoeLh+lTWPVLouX2RiBERlq4qAOgM8aK+g= sha384-VVOeJV8okLf6owAyITVK14p3AX78fPOStksa5tYEruAngS4yv5EYM26KP9bvcZ/L sha512-DrEJKCUTeTeOenmoMwQa6d3KSiKXCFdZjjbsJhzh4vYFXPxjoU8dfd8oISmIDqrkkRYeCriuEC5TEah3aONxsg==
-last_modified_at: 2026-10-25
+last_modified_at: 2026-10-29
 ---
 
 If you want to use SRI you can do this by using specific scripts. The default scripts are changing to reflect new features or code optimizations. You want to use SRI if you consider it a risk when our scripts change. You can also host our SRI script on your own server or CDN.
@@ -17,7 +18,49 @@ When you want to use our SRI version of our script you will need to update your
 <noscript><img src="https://queue.simpleanalyticscdn.com/noscript.gif" alt="" referrerpolicy="no-referrer-when-downgrade" /></noscript>
 ```
 
-When using a [custom domain](/bypass-ad-blockers) you need to use this script: `https://CUSTOM.DOMAIN/v{{ page.sriVersion }}/app.js`. Replace the `CUSTOM.DOMAIN` with your custom domain. To generate an SRI hash for your custom domain you can use [report-uri.com](https://report-uri.com/home/sri_hash) or [srihash.org](https://www.srihash.org/).
+When using a [custom domain](/bypass-ad-blockers), use `https://CUSTOM.DOMAIN/sri/v{{ page.sriVersion }}.js` instead. That script contains your custom domain, so its hash differs from the one above. Enter your custom domain to get the embed script with its hash, calculated in your browser:
+
+<form id="sri-custom-domain" data-version="{{ page.sriVersion }}">
+  <input type="text" name="domain" placeholder="custom.domain.com" aria-label="Custom domain" autocomplete="off" autocapitalize="off" spellcheck="false" required />
+  <button type="submit">Get the script</button>
+</form>
+<p id="sri-custom-domain-error" hidden></p>
+<div id="sri-custom-domain-result" class="highlight" hidden><pre class="highlight"><code></code></pre></div>
+<script>
+  (function () {
+    var form = document.getElementById("sri-custom-domain");
+    if (!form || form.dataset.ready) return;
+    form.dataset.ready = "true";
+    var error = document.getElementById("sri-custom-domain-error");
+    var result = document.getElementById("sri-custom-domain-result");
+    var latest = 0;
+    form.addEventListener("submit", async function (event) {
+      event.preventDefault();
+      // Only the latest submission may show its result
+      var submission = ++latest;
+      error.hidden = true;
+      result.hidden = true;
+      var domain = form.domain.value.trim().toLowerCase().replace(/^[a-z]+:\/\//, "").split(/[\/?#]/)[0];
+      var src = "https://" + domain + "/sri/v" + form.dataset.version + ".js";
+      try {
+        var response = await fetch(src, { cache: "no-store" });
+        var body = await response.arrayBuffer();
+        // Only the SRI version is pinned; latest.js changes with every release
+        var firstLine = new TextDecoder().decode(body.slice(0, 300)).split("\n")[0];
+        if (!response.ok || firstLine.indexOf("SRI-version") === -1) throw new Error("Not an SRI script");
+        var digest = new Uint8Array(await crypto.subtle.digest("SHA-384", body));
+        if (submission !== latest) return;
+        var hash = "sha384-" + btoa(String.fromCharCode.apply(null, digest));
+        result.querySelector("code").textContent = '<script async src="' + src + '" integrity="' + hash + '" crossorigin="anonymous"></' + "script>";
+        result.hidden = false;
+      } catch (e) {
+        if (submission !== latest) return;
+        error.textContent = "We couldn't find the SRI script at " + src + ". Check that " + domain + " is set up as your custom domain.";
+        error.hidden = false;
+      }
+    });
+  })();
+</script>
 
 To verify if our script is an SRI version you can always check for `SRI-version` in the first line: