CSP Inline Hash Generator
Paste the exact contents of an inline <script>
or <style> block and get the
sha256- / sha384- / sha512-
Content-Security-Policy hash for it, computed in your browser with
the Web Crypto API. Also shows the hash with a trailing newline
stripped — the single most common reason a copy-pasted hash
doesn't match what the browser expects.
Why doesn't my CSP hash match what the browser expects?
CSP hashes are computed over the exact bytes of the script/style
content — nothing is trimmed automatically. If you saved that
content to a file and hashed the file (e.g. with
sha256sum), most editors silently add a trailing
newline, which changes the hash the browser checks it against.
This tool computes both variants so you can see immediately
whether that's what's biting you.
What algorithm does this tool use to compute the hash?
It takes the UTF-8 bytes of exactly what you paste, runs them
through SHA-256 (and SHA-384/SHA-512), and base64-encodes the
digest — the same value browsers compute internally, formatted
as the 'sha256-<base64>' source expression
you put in a script-src or style-src
CSP directive. No normalization or trimming happens unless you
explicitly compare the trailing-newline variant shown below.
Does this tool send my code anywhere?
No. Hashing runs entirely in your browser via the Web Crypto
SubtleCrypto API — nothing you paste is uploaded or
transmitted.