CSP nonce and hash generator

Nonces come from the browser CSPRNG and never leave this tab; hashes run through the WebCrypto digest of your pasted text. Neither mechanism is fetched, stored, or synced. Nonces and hashes answer different problems: a nonce allows one generated tag per response, a hash allows one fixed snippet forever. Mixing them under the same directive is allowed, but a script-src with strict-dynamic ignores hashes entirely. When you allow inline scripts at all, the CSP evaluator can read the whole policy and tell you what else slipped in.