CSP Hash Generator

Trying to allow a specific inline script in your Content Security Policy without using 'unsafe-inline'? CSP hash values let you whitelist exact inline script or style content by its cryptographic hash. This tool generates SHA-256, SHA-384, and SHA-512 hashes using the Web Crypto API, formatted as CSP hash source values ready to paste into your Content-Security-Policy header. Paste your inline script or style content below and select your algorithm.

Select a hash algorithm (SHA-256, SHA-384, or SHA-512) from the dropdown. Paste the exact content of your inline script or style element into the input field. The tool encodes the text using the TextEncoder API and passes it to crypto.subtle.digest, which computes the hash asynchronously. The resulting hash bytes are converted to Base64 and formatted as a CSP hash source value (e.g., 'sha256-XyZ...='). Copy the output and add it to your Content-Security-Policy header's script-src or style-src directive.

Content Security Policy (CSP) is a HTTP response header that lets website operators restrict the sources of content that browsers will load on a page. It is defined in the CSP Level 2 specification by the W3C and further extended in CSP Level 3. One of the key features of CSP is controlling inline scripts and styles. By default, a CSP header with a script-src directive blocks all inline scripts. To allow a specific inline script without using 'unsafe-inline' (which defeats the purpose of CSP), you can use a hash source. The hash source format is `'algorithm-base64hash'`, where algorithm is sha256, sha384, or sha512, and base64hash is the Base64-encoded hash of the script content. For example: `Content-Security-Policy: script-src 'sha256-2da...='`. The browser computes the hash of the inline script at load time and compares it to the hash in the CSP header. If they match, the script executes. If not, the browser blocks it and reports the violation. The hash must be computed over the exact text content of the script element, including whitespace and newlines. The Web Crypto API provides the `crypto.subtle.digest()` method, which implements the same SHA-256, SHA-384, and SHA-512 algorithms defined in FIPS 180-4 by NIST. This tool uses that API directly, ensuring the hashes are computed using the browser's native cryptographic implementation. Note that CSP hashes are fragile: any change to the inline script content (even adding a space) invalidates the hash. For frequently changing scripts, consider using nonces instead of hashes.