CSP Nonce and Hash Generator

Generate cryptographically secure CSP nonces and SHA-256, SHA-384 or SHA-512 hashes for inline script and style blocks, with the matching policy fragment.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Nonces

Generated with your browser's cryptographic random number generator. Generate a fresh one per response on your server - the values here are for testing and for seeing the format.

Random bytes The CSP specification requires at least 128 bits of entropy.

How many

Hashes for inline script or style

Paste the exact contents of an inline block - everything between the tags, and nothing else. The hash covers those bytes precisely.

Inline content Do not include the <script> or <style> tags themselves.

Directive

Nonces and hashes, and when to use which

A Content Security Policy that allows 'unsafe-inline' does not stop the most common form of cross-site scripting, because an injected <script> tag is inline script. Nonces and hashes are the two ways to keep the inline code you wrote while still blocking the inline code someone else injects.

A nonce is a random value generated fresh for every response, placed on your own script tags and named in the policy. The browser runs an inline script only if its nonce matches. Use nonces when your inline content changes, or when there is a lot of it.
A hash is a digest of the exact contents of one inline block. The browser runs it only if the contents hash to that value. Use hashes when the inline content is fixed and you cannot generate a per-response value - a static site, or a page served from a cache.

A nonce must be new every time

This is the mistake that makes the whole mechanism worthless. If the nonce is a constant in your configuration, or is cached along with the page, an attacker simply reads it from the HTML and puts it on their own injected script. A reused nonce is no protection at all - it is 'unsafe-inline' with extra steps.

Generate it on the server, per response, from a cryptographic source: crypto/rand in Go, secrets.token_urlsafe in Python, RandomNumberGenerator in .NET, crypto.randomBytes in Node. Then make sure the page carrying it is not cached, or the nonce is cached with it.

Hashes cover the bytes exactly

The hash is taken over the literal contents of the element - every space, every newline, every tab. Change one character of whitespace and the hash no longer matches and the script stops running. This catches people out when a build step reformats or minifies inline blocks, so calculate hashes after minification, not before.

Note also that hashes apply to inline blocks. Since CSP Level 3 a hash in script-src can also match an external script, but only alongside 'strict-dynamic' and with the integrity attribute involved - for ordinary use, treat hashes as an inline mechanism and use SRI Hash Generator for external files.

Which algorithm

CSP accepts SHA-256, SHA-384 and SHA-512, and all three are currently considered secure for this purpose. SHA-256 is the usual choice and produces the shortest policy. There is no security reason to prefer the longer ones here; the tool produces all three so you can pick what fits your conventions.

Everything on this page is local

Nonces are generated with crypto.getRandomValues and hashes with crypto.subtle.digest, both in your browser. Nothing you paste is transmitted. That is not just a privacy nicety for this particular tool - inline script frequently contains configuration, API endpoints and occasionally keys that were never meant to be shared.

Frequently asked questions

Can I use the nonces generated here in production?

No. Use them to test your policy and to see the format. A nonce must be generated per response by your server - a value copied from a web page is by definition a fixed nonce, and a fixed nonce provides no protection.

My hash does not match and the script is blocked. Why?

Almost always whitespace. The hash covers the exact bytes between the tags, including leading and trailing newlines and indentation. Copy the content precisely, and calculate it after any minification step rather than before.

Can I use a nonce and a hash together?

Yes, and it is common during migration - hashes for the blocks you cannot change and a nonce for the rest. Note that as soon as either is present, browsers ignore 'unsafe-inline' entirely.

Do nonces work in a meta tag policy?

They do, but the policy has to be rendered per response for the nonce to be fresh, which removes most of the reason to use a meta tag. A response header is the better place.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.