Tools

CSP Hash Calculator

Generate SHA-256 hashes for inline scripts. Copy the hash directly into your Content Security Policy.

CSP Hash Calculator
Generated Hashes
SHA-256 Recommended
Calculating...
SHA-384
Calculating...
SHA-512
Calculating...
CSP Directive (using SHA-256)
Calculating...
HTML with matching script:
...
How it works: The browser calculates the hash of your inline script content (excluding <script> tags) and compares it against the hash in your CSP header. If they match, the script executes. Any change to the script—even whitespace—invalidates the hash. SHA-256 is recommended for broad compatibility.

About This Tool

When you need to allow specific inline scripts or styles in your Content Security Policy (CSP) without using ‘unsafe-inline’, you can use cryptographic hashes. This tool calculates the SHA-256 hash of your content in the exact base64 format that browsers expect.

Features

  • Real-time calculation — hash updates instantly as you type or paste

  • Multiple algorithms — supports SHA-256, SHA-384, and SHA-512

  • Ready-to-use directives — get the full ‘sha256-…’ string or the complete script-src line

  • Automatic cleanup — removes leading/trailing whitespace automatically if selected

  • Client-side only — your sensitive scripts are never sent to a server

How Do I Use This Tool?

  1. Paste your inline script or style content (excluding <script> or <style> tags)

  2. Copy the generated hash or full CSP directive

  3. Add the hash to your script-src or style-src directive in your Nginx/Apache config or meta tag

Important Notes

  • Exact matching — Any change to the script (even a single space or newline) will result in a completely different hash and cause the browser to block the script.

  • No tags — Do not include the <script> or <style> HTML tags themselves, only the inner content.

  • Dynamic scripts — If your script contains dynamic values (like a user ID), hashes won’t work. Consider using

    nonces

    instead.

  • See

    the complete CSP guide

    for best practices

Privacy

Security is the priority. All cryptographic operations are performed locally in your browser using the Web Crypto API. Your script content is never transmitted over the network.

Linux Command Reference

You can also calculate these hashes manually in your terminal using standard Linux utilities.

SHA-256 for CSP

echo -n ‘console.log(“Hello CSP”);’ | openssl dgst -sha256 -binary | openssl base64
7fJ6A1b9qS8r…[hash]…=

SHA-384 for SRI (Subresource Integrity)

cat script.js | openssl dgst -sha384 -binary | openssl base64 -A
Nkhj…[base64 hash]…

Frequently asked questions

When should I use a CSP hash instead of a nonce?

Use a hash for inline scripts or styles whose content never changes, so you can allow them without "unsafe-inline". If the script contains dynamic values like a user ID, use a nonce instead, because any change to the content breaks the hash.

Why does my inline script still get blocked after adding the hash?

CSP hashes require an exact byte-for-byte match, so even a single extra space or newline produces a different hash and the browser blocks the script. Make sure you hash only the inner content, without the surrounding "<script>" or "<style>" tags.

What is the difference between a CSP hash and an SRI hash?

A CSP hash (SHA-256 base64) authorizes specific inline code in your Content Security Policy. An SRI hash (typically SHA-384) goes in the "integrity" attribute of an external script or link tag to verify a fetched file has not been tampered with.

Is my script content sent to a server?

No. All hashing runs locally in your browser using the Web Crypto API, so your script or style content is never transmitted over the network.

Which hash algorithm should I choose?

SHA-256 is the standard and most widely supported choice for CSP. SHA-384 and SHA-512 are also valid and are commonly used for Subresource Integrity, but SHA-256 is sufficient for nearly all CSP use cases.