Bootstrap CDN: Latest Bootstrap 5.3.9 Links with SRI

The fastest way to add Bootstrap to a page is a CDN link: two lines of HTML that load the CSS and JavaScript from a public server, with nothing to install. This guide gives the current Bootstrap CDN links with their integrity hashes, a complete starter page, the other files you can load (Popper, the ES module build, RTL, grid only, and Bootstrap Icons), and explains when to switch from a CDN to npm or your own compiled theme.

The latest stable release is Bootstrap 5.3.9, released on November 11, 2026. All links below are for that version.

Bootstrap CDN links

CSS

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/css/bootstrap.min.css"
  integrity="sha384-yEPZ7jP9S0QKiUQ0m3jjsO4ProIW7wvR9gXkI7JOGa2XVsw53Yke2bsdkBbjmmiX" crossorigin="anonymous">

JavaScript (bundle with Popper)

<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/js/bootstrap.bundle.min.js"
  integrity="sha384-WyOxWvTyr1QaMPfiPJSv76iReVthorl5uWlFtZPyK0IEB0hGzo9y5Bp9mYanr8Bu" crossorigin="anonymous"></script>

The bundle includes Popper, which dropdowns, tooltips, and popovers need. Use it unless you have a reason to load Popper separately.

Starter template

A complete page to copy and start from:

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>My page</title>
    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/css/bootstrap.min.css"
      integrity="sha384-yEPZ7jP9S0QKiUQ0m3jjsO4ProIW7wvR9gXkI7JOGa2XVsw53Yke2bsdkBbjmmiX" crossorigin="anonymous">
  </head>
  <body>
    <main class="container py-5">
      <h1>Hello, Bootstrap</h1>
      <button class="btn btn-primary">It works</button>
    </main>
    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/js/bootstrap.bundle.min.js"
      integrity="sha384-WyOxWvTyr1QaMPfiPJSv76iReVthorl5uWlFtZPyK0IEB0hGzo9y5Bp9mYanr8Bu" crossorigin="anonymous"></script>
  </body>
</html>

• The viewport meta tag is required for the page to be responsive on phones. Without it, phones show a zoomed-out desktop page.
• The CSS goes in <head>, so the page is styled before it appears.
• The script goes before </body>, so it doesn’t delay the page from showing.
• <!doctype html> keeps the browser in standards mode, which Bootstrap needs.

What integrity and crossorigin do

The integrity attribute is a fingerprint of the file. The browser checks the downloaded file against it and refuses to run anything that doesn’t match, so a compromised or altered CDN file can’t run on your page. crossorigin="anonymous" is required for that check on files from another domain.

Each hash belongs to one exact file. If you change the version number in the URL, you must change the hash too, or the browser blocks the file. Copy hashes from a trusted source, such as the official Bootstrap docs or the jsDelivr page for the package.

Other files

File	Use it for	Gzipped size
css/bootstrap.min.css	Everything (the normal choice)	31 KB
css/bootstrap-grid.min.css	Only the grid and flex utilities	6 KB
css/bootstrap-utilities.min.css	Only the utility classes	11 KB
css/bootstrap-reboot.min.css	Only the base reset	3 KB
css/bootstrap.rtl.min.css	Right-to-left languages	31 KB
js/bootstrap.bundle.min.js	All components, with Popper	24 KB
js/bootstrap.min.js	All components, without Popper	17 KB
js/bootstrap.esm.min.js	ES module imports

All of them live under https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/.

Bootstrap JS without the bundle

Load Popper first, then Bootstrap:

<script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/popper.min.js"
  integrity="sha384-I7E8VVD/ismYTF4hNIPjVp/Zjvgyol6VFvRkX/vR+Vc4jQkC+hVqc2pM8ODewa9r" crossorigin="anonymous"></script>
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/js/bootstrap.min.js"
  integrity="sha384-89aa4glufciPv46aKltztWQEmk+Tu9W2RhzXr6VcnUUEub7F8+06RcL2RYLCOHUq" crossorigin="anonymous"></script>

If you don’t use dropdowns, tooltips, or popovers, you can skip Popper entirely.

Right-to-left (RTL)

For Arabic, Hebrew, Persian, and other right-to-left languages, set dir="rtl" and the language on <html>, and use the RTL stylesheet:

<html lang="ar" dir="rtl">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/css/bootstrap.rtl.min.css"
  integrity="sha384-fFMX5LqaHoT6olm8r/JTe3Dg4+vFEFXrVlhIo8IGs96iA+JhgKLLYwY4y2fHeyMY" crossorigin="anonymous">

ES modules

To import components in a <script type="module">, map Bootstrap and Popper with an import map:

<script type="importmap">
{
  "imports": {
    "@popperjs/core": "https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/esm/popper.min.js",
    "bootstrap": "https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/js/bootstrap.esm.min.js"
  }
}
</script>
<script type="module">
  import * as bootstrap from 'bootstrap'
  new bootstrap.Popover(document.querySelector('#example'), { content: 'Loaded as a module' })
</script>

Bootstrap Icons

Icons are a separate package with their own CDN link:

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.13.2/font/bootstrap-icons.min.css"
  integrity="sha384-nWN3KqaaVcbEsCjLSV+2jMjh62Iny/+mN3srM8TZeM8N6aj7eDl5wwYggjAJ4/sJ" crossorigin="anonymous">

Then use <i class="bi bi-check-circle"></i>. The Bootstrap Icons guide covers sizes, colors, and SVG use.

cdnjs as an alternative

The same files are on cdnjs, with identical hashes because the files are identical:

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/5.3.9/css/bootstrap.min.css"
  integrity="sha384-yEPZ7jP9S0QKiUQ0m3jjsO4ProIW7wvR9gXkI7JOGa2XVsw53Yke2bsdkBbjmmiX" crossorigin="anonymous">
<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/5.3.9/js/bootstrap.bundle.min.js"
  integrity="sha384-WyOxWvTyr1QaMPfiPJSv76iReVthorl5uWlFtZPyK0IEB0hGzo9y5Bp9mYanr8Bu" crossorigin="anonymous"></script>

jsDelivr is the CDN the Bootstrap docs use. Both are free and fast; pick one and use it for every file.

Pin the exact version

jsDelivr accepts version ranges such as bootstrap@5 or no version at all, which always serve the newest release. Avoid them on real sites:

• A new release can change how your page looks without any change on your side.
• An integrity hash can’t work with a range, because the file behind the URL changes.

Use the full version (@5.3.9) and update it on purpose. Bootstrap 6 is in alpha (6.0.0-alpha.1 at the time of writing); stay on 5.3 for production sites until 6 is stable.

Older versions

Version	CSS link
Bootstrap 5.3.8	https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css
Bootstrap 4.6.2	https://cdn.jsdelivr.net/npm/bootstrap@4.6.2/dist/css/bootstrap.min.css
Bootstrap 3.4.1	https://cdn.jsdelivr.net/npm/bootstrap@3.4.1/dist/css/bootstrap.min.css

Bootstrap 4 and 3 no longer get updates. Bootstrap 4’s JavaScript also needs jQuery, so moving to 5 removes a dependency. The differences are summed up in what is Bootstrap.

CDN, npm, or your own build?

	CDN	npm and Sass	Compiled custom theme
Setup	Two lines of HTML	A build tool	Edit, export, upload
Custom colors and fonts	CSS variables only	Full, through Sass variables	Full
File size	Whole framework	Only what you import	Whole or trimmed
Best for	Prototypes, simple sites, demos	Apps with a build step	Static sites that need a custom look

A CDN loads stock Bootstrap, with its default blue and system fonts. You can override CSS variables after it, but changing theme colors properly, including every hover and focus shade, needs Sass. If you don’t want a build step, design your theme in the bootstrap.build editor, export the compiled CSS, and load that file instead of the CDN stylesheet. To make the file smaller, see how to reduce Bootstrap CSS size.

FAQ

What is the Bootstrap 5 CDN link?

For Bootstrap 5.3.9, the CSS is https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/css/bootstrap.min.css and the JavaScript is https://cdn.jsdelivr.net/npm/bootstrap@5.3.9/dist/js/bootstrap.bundle.min.js. Put the CSS in <head> and the script before </body>, with the integrity hashes shown in this guide.

What is the latest version of Bootstrap?

The latest stable version is Bootstrap 5.3.9, released on November 11, 2026. Bootstrap 6 is in alpha and isn’t recommended for production yet.

Do I need Popper with the Bootstrap CDN?

Only if you use dropdowns, tooltips, or popovers, and bootstrap.bundle.min.js already includes it. If you load bootstrap.min.js instead, add Popper’s script before it.

Is it safe to use Bootstrap from a CDN?

Yes, when you pin an exact version and include the integrity and crossorigin attributes. The browser then refuses any file that doesn’t match the expected fingerprint. For strict privacy rules or offline use, host the files on your own server instead.

Can I customize Bootstrap loaded from a CDN?

Partly. You can override Bootstrap’s CSS variables and add your own CSS after the CDN stylesheet. For full control over colors, fonts, and spacing, compile Bootstrap with Sass, or build a theme visually and load the exported CSS file instead of the CDN link.