---
title: "Free CSP hash generator - inline script & style SHA-256"
description: "Paste an inline script or style, get its SHA-256, 384 or 512 CSP hash and a ready-to-paste script-src line. Drop unsafe-inline. Nothing leaves your browser."
url: "https://centralcsp.com/en/tools/csp-hash/"
lang: "en"
---

Tools

# CSP hash calculator

Paste an inline script or style and get its hash to allowlist it in your Content-Security-Policy.

Inline script or style content [Learn how CSP hashes work](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce) Hashing runs locally in your browser through the Web Crypto API. Nothing is uploaded.

256 384 512

Calculate hash

Need an integrity hash for a remote file? [Use the SRI calculator](https://centralcsp.com/en/tools/sri-hash/)

Guide

## Understanding CSP hashes

This CSP hash generator lets you keep a specific inline script or style in your pages while running a strict Content-Security-Policy, without falling back to the unsafe 'unsafe-inline' keyword.

### What is a CSP hash?

A CSP hash is a base64-encoded SHA digest of the exact contents of an inline script or style element. You add it to your policy so the browser executes only that exact snippet and blocks everything it did not expect.

Because the value is derived from the code itself, a strict policy can allow the inline code you trust while still stopping any script an attacker manages to inject into the page. Read the full explanation in the [CSP hashes and nonces guide](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce).

### Remove unsafe-inline without breaking your inline scripts

Copy the generated value, including the sha256- prefix and the surrounding quotes, into your script-src directive for scripts or style-src for styles. You can list several hashes in the same directive.

Hash only the content between the tags, never the script or style tags themselves. The digest must match the inline content byte for byte, so a single added space or line break produces a different hash and the browser will reject it. For the complete directive syntax, see the [script-src directive](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/directives/script-src).

```
Content-Security-Policy:
  script-src 'self' 'sha256-RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc=';

# the same generated value, for an inline <style> block instead
Content-Security-Policy:
  style-src 'self' 'sha256-RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc=';
```

### Why your CSP hash does not match

Almost every mismatch is a byte that changed after you hashed. A template engine or a minifier reformatted the script on the next build; a CDN stripped or added whitespace inside the tag; the value was taken from the tags rather than from the content between them; or an editor left a trailing newline the browser does not see the same way you do.

The shortcut is to let the browser tell you. When a policy blocks an inline script, the console violation message prints the sha256 value the browser computed for that exact content, so you can copy it straight out of DevTools instead of guessing which byte moved.

One rule that catches people out: a hash in script-src does not cover inline event handler attributes such as onclick. Those are governed by script-src-attr and need 'unsafe-hashes', a weaker construct worth avoiding. Move the handler into the script block instead.

### SHA-256, SHA-384, or SHA-512?

Content-Security-Policy accepts three algorithms. SHA-256 is the most widely used and is more than enough for every site; SHA-384 and SHA-512 produce longer values with no practical benefit for CSP. Pick one algorithm and use it consistently across your policy.

### Hashes or nonces?

unsafe-inline, hashes and nonces compared
| Approach | What it allows | Breaks when the code changes | Needs a per-request server |
| --- | --- | --- | --- |
| `'unsafe-inline'` | Every inline script on the page, including injected ones | No | No |
| Hash | Exactly the snippet you hashed, byte for byte | Yes, and that is the point | No |
| Nonce | Any script carrying this request's nonce attribute | No | Yes, a fresh value per response |

When you can modify the response on every request, prefer a nonce: it is unguessable, single-use, and keeps working even when the inline code changes, which makes it the more robust default. Reach for a hash only when a nonce is not practical, for static inline snippets or third-party code you cannot stamp per request. Strict policies usually lead with a nonce plus strict-dynamic and fall back to hashes where a nonce cannot reach. Both mechanisms are covered in depth in the [CSP hashes and nonces guide](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce).

```
script-src 'self' 'nonce-2726c7f26c' 'strict-dynamic';
```

Keep reading

-   [CSP hashes and nonces](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce)
-   [The script-src directive](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/directives/script-src)
-   [The style-src directive](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/directives/style-src)
-   [Content-Security-Policy overview](https://centralcsp.com/en/docs/web-security/policies/content-security-policy)
-   [How to generate a CSP hash (sha256)](https://centralcsp.com/en/blog/csp-hash-sha256)
-   [SRI vs CSP hash, two hashes that do different jobs](https://centralcsp.com/en/blog/sri-vs-csp-hash)
-   [Set up a CSP nonce per request](https://centralcsp.com/en/blog/csp-nonce-setup)
-   [CSP keywords, including unsafe-hashes](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/values/csp-keywords)

More free tools

## Keep auditing with the other free tools

Every tool is free, runs without an account, and scores with the same severity scale.

### CSP scanner

Fetch a URL's live Content-Security-Policy and score it against known bypasses, wildcard sources and missing directives.

-   Directive-level findings
-   Shareable results link

[Run the CSP scanner](https://centralcsp.com/en/tools/csp-scanner/)

### CSP evaluator

Paste a policy that is not deployed yet and get the same scoring and findings as a live scan, no URL required.

-   Audit before you ship
-   Same scoring engine

[Evaluate a policy in the CSP evaluator](https://centralcsp.com/en/tools/csp-evaluator/)

### Security headers scanner

Grade every security header a URL sends, from HSTS to Permissions-Policy, with each finding explained and prioritized.

-   Every header, one grade
-   Fix list ordered by impact

[Scan your security headers](https://centralcsp.com/en/tools/security-headers/)

### Reporting API checker

Check that violation reporting actually works: endpoints, Reporting-Endpoints and Report-To, and which security features really report.

-   Endpoint and feature mapping
-   Silent drops flagged

[Check your Reporting API setup](https://centralcsp.com/en/tools/reporting-api/)

### SRI hash generator

Turn a CDN script or stylesheet URL into its Subresource Integrity hash, with a ready-to-paste tag and a CORS check.

-   SHA-256, 384 and 512
-   CORS verified for you

[Generate an SRI hash](https://centralcsp.com/en/tools/sri-hash/)

### Website compare

See where your score stands: your site beside the dataset average and the year's best-configured sites, control by control.

-   Published, auditable references
-   Radar view per category

[Compare your site to the best](https://centralcsp.com/en/tools/compare/)

FAQ

## Frequently asked questions

Hashing, matching and where the value goes, answered.

### Do I include the <script> tags when hashing?

No. Hash only the content between the tags. The browser computes its digest over the element's text content, so including <script> or </script> produces a value that will never match and the script stays blocked.

### Why is my CSP hash still blocked?

Because the content changed by at least one byte after you hashed it. A minifier or template reformatted the script, a CDN altered the whitespace, or an editor left a trailing newline. The digest is byte-exact by design. The fastest fix is to read the console violation message, which prints the sha256 value the browser computed for the content it actually saw.

### Does a CSP hash work for inline styles?

Yes. The same generated value goes into style-src instead of script-src when you hashed the contents of an inline <style> block. The mechanism is identical; only the directive changes.

### Can I list several hashes in one directive?

Yes, and that is the normal case. Add one quoted hash per inline snippet you want to allow, separated by spaces, in the same script-src or style-src directive. The browser allows a snippet whose digest matches any of them.

### Should I use a hash or a nonce?

Prefer a nonce when you can set a fresh value on every response: it keeps working when the inline code changes, which a hash deliberately does not. Reach for a hash when a nonce is not practical, for static inline snippets or third-party code you cannot stamp per request. Strict policies usually lead with a nonce plus strict-dynamic and fall back to hashes where a nonce cannot reach.

## See if your CSP breaks?

CentralCSP collects real Content-Security-Policy reports from your visitors' browsers, so you catch a broken policy or a blocked script before it costs you. Add one header, no code changes.

[Start with CentralCSP](https://app.centralcsp.com) [Turn script hashes into PCI evidence](https://centralcsp.com/en/platform/pci-dss/)

---

Available in: [en](https://centralcsp.com/en/tools/csp-hash/), [fr](https://centralcsp.com/fr/tools/csp-hash/)