Your files stay on your device

# CSP nonce and hash generator

Generate base64 CSP nonces from WebCrypto and turn pasted inline content into sha256, sha384, or sha512 source expressions with the script-src or style-src fragment.

Pick a size and generate a batch; nothing is stored anywhere.

Paste the inline script or style text; the hash appears as you type.

Nonces come from the browser CSPRNG and never leave this tab; hashes run through the WebCrypto digest of your pasted text. Neither mechanism is fetched, stored, or synced. Nonces and hashes answer different problems: a nonce allows one generated tag per response, a hash allows one fixed snippet forever. Mixing them under the same directive is allowed, but a script-src with strict-dynamic ignores hashes entirely. When you allow inline scripts at all, the CSP evaluator can read the whole policy and tell you what else slipped in.
Options

## More web & auth tools

- [CSP evaluator & builder](/web/csp)
- [Subresource integrity](/web/sri)
- [Hash generator](/crypto/hash)
[All web & auth tools](/web)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/web/csp-nonce-hash-generator
Markdown version: https://nutter.tools/web/csp-nonce-hash-generator.md
Plain-text version: https://nutter.tools/web/csp-nonce-hash-generator.txt
Agent index: https://nutter.tools/llms.txt