Your files stay on your device

CSP nonce and hash generator

Generate base64 CSP nonces from WebCrypto and turn pasted inline content into sha256, sha384, or sha512 source expressions with the script-src or style-src fragment.

Pick a size and generate a batch; nothing is stored anywhere.

Paste the inline script or style text; the hash appears as you type.

Nonces come from the browser CSPRNG and never leave this tab; hashes run through the WebCrypto digest of your pasted text. Neither mechanism is fetched, stored, or synced. Nonces and hashes answer different problems: a nonce allows one generated tag per response, a hash allows one fixed snippet forever. Mixing them under the same directive is allowed, but a script-src with strict-dynamic ignores hashes entirely. When you allow inline scripts at all, the CSP evaluator can read the whole policy and tell you what else slipped in.
Options

More web & auth tools

- CSP evaluator & builder (/web/csp)
- Subresource integrity (/web/sri)
- Hash generator (/crypto/hash)
All web & auth tools (/web)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/web/csp-nonce-hash-generator
Markdown version: https://nutter.tools/web/csp-nonce-hash-generator.md
Plain-text version: https://nutter.tools/web/csp-nonce-hash-generator.txt
Agent index: https://nutter.tools/llms.txt