# CSP Hash Calculator

> One page from jmrp.io, published as markdown. Index: https://jmrp.io/llms.txt

Canonical: https://jmrp.io/tools/hash-calculator/
Language: en
Alternate: https://jmrp.io/es/tools/hash-calculator/index.md
Updated: 2026-08-23
License: https://jmrp.io/license/
Category: security
Tags: csp, hash, sha256, security, sri

Generate SHA-256 hashes for inline scripts. Get ready-to-use CSP directives for your Content Security Policy. Runs client-side.
Build-Date: 2026-09-06

Features:
- Real-time SHA-256 hashing as you type
- Supports SHA-256, SHA-384 and SHA-512
- Outputs ready-to-use CSP script-src directives
- Optional whitespace cleanup before hashing
- Web Crypto API, content never sent to a server

Questions answered:

**When should I use a CSP hash instead of a nonce?**

Use a hash for inline scripts or styles whose content never changes, so you can allow them without "unsafe-inline". If the script contains dynamic values like a user ID, use a nonce instead, because any change to the content breaks the hash.

**Why does my inline script still get blocked after adding the hash?**

CSP hashes require an exact byte-for-byte match, so even a single extra space or newline produces a different hash and the browser blocks the script. Make sure you hash only the inner content, without the surrounding "<script>" or "<style>" tags.

**What is the difference between a CSP hash and an SRI hash?**

A CSP hash (SHA-256 base64) authorizes specific inline code in your Content Security Policy. An SRI hash (typically SHA-384) goes in the "integrity" attribute of an external script or link tag to verify a fetched file has not been tampered with.

**Is my script content sent to a server?**

No. All hashing runs locally in your browser using the Web Crypto API, so your script or style content is never transmitted over the network.

**Which hash algorithm should I choose?**

SHA-256 is the standard and most widely supported choice for CSP. SHA-384 and SHA-512 are also valid and are commonly used for Subresource Integrity, but SHA-256 is sufficient for nearly all CSP use cases.


---

**Interactive tool** — this page hosts the working application itself, not a description of one.

## About This Tool

When you need to allow specific inline scripts or styles in your Content Security Policy (CSP) without using `'unsafe-inline'`, you can use cryptographic hashes. This tool calculates the SHA-256 hash of your content in the exact base64 format that browsers expect.

### Features

- **Real-time calculation** — hash updates instantly as you type or paste
- **Multiple algorithms** — supports SHA-256, SHA-384, and SHA-512
- **Ready-to-use directives** — get the full `'sha256-...'` string or the complete `script-src` line
- **Automatic cleanup** — removes leading/trailing whitespace automatically if selected
- **Client-side only** — your sensitive scripts are never sent to a server

### How Do I Use This Tool?

1. Paste your inline script or style content (excluding `<script>` or `<style>` tags)
2. Copy the generated hash or full CSP directive
3. Add the hash to your `script-src` or `style-src` directive in your Nginx/Apache config or meta tag

### Important Notes

- **Exact matching** — Any change to the script (even a single space or newline) will result in a completely different hash and cause the browser to block the script.
- **No tags** — Do not include the `<script>` or `<style>` HTML tags themselves, only the inner content.
- **Dynamic scripts** — If your script contains dynamic values (like a user ID), hashes won't work. Consider using [nonces](https://jmrp.io/blog/003-implementing-content-security-policy-nginx/#solution-3-use-nonces) instead.
- See [the complete CSP guide](https://jmrp.io/blog/003-implementing-content-security-policy-nginx/) for best practices

### Privacy

Security is the priority. All cryptographic operations are performed locally
in your browser using the Web Crypto API. Your script content is never
transmitted over the network.

### Linux Command Reference

You can also calculate these hashes manually in your terminal using standard
Linux utilities.

#### SHA-256 for CSP

```bash
echo -n 'console.log("Hello CSP");' | openssl dgst -sha256 -binary | openssl base64
```

**SHA-256 Base64 Hash Output**

```text
7fJ6A1b9qS8r...[hash]...=
```

#### SHA-384 for SRI (Subresource Integrity)

```bash
cat script.js | openssl dgst -sha384 -binary | openssl base64 -A
```

**SHA-384 Base64 Hash Output**

```text
Nkhj...[base64 hash]...
```