CSP Nonce & Hash Generator
Generate cryptographically secure nonces for inline scripts and compute SHA-256 / SHA-384 hashes to use in your Content Security Policy — instantly, in your browser.
Generate a Cryptographic Nonce
A nonce is a unique, random base64 value added to your CSP and matching <script nonce="..."> tags. It allows specific inline scripts without using 'unsafe-inline'.
JA8paV85pivM/30aAXXOXg=='nonce-JA8paV85pivM/30aAXXOXg=='script-src 'self' 'nonce-JA8paV85pivM/30aAXXOXg==';<script nonce="JA8paV85pivM/30aAXXOXg==">...</script>Automate Nonce Injection in Production
CSP Radar's middleware integrations auto-inject nonces into your pages and track violations in real-time. No manual hash management.
Start FreeCSP Nonces vs Hashes — Which Should You Use?
Both nonces and hashes allow you to permit specific inline scripts or styles in your CSP without resorting to 'unsafe-inline' — which completely defeats XSS protection.
A nonce (number used once) is a randomly generated base64 string. You set it in your CSP header (script-src 'nonce-abc123') and add the matching attribute to your script tag (<script nonce="abc123">). Because the nonce changes with every request, attackers cannot predict it and inject scripts that pass the check.
A hash is a cryptographic fingerprint of the exact script content. If the content matches the hash in your CSP, the browser executes it. Hashes are ideal for static inline scripts that don't change between page loads.
Google's security team strongly recommends the nonce approach for dynamic sites. Read their full guidance: Strict Content Security Policy on web.dev ↗
The MDN documentation on script-src ↗ has detailed examples of both nonce and hash usage. For the cryptographic specification behind the hash algorithm, see the W3C CSP Level 3 specification ↗.
How Nonces Work — Step by Step
- Your server generates a random 128-bit (16-byte) cryptographically secure value and base64-encodes it.
- The nonce is added to the HTTP response header:
Content-Security-Policy: script-src 'nonce-abc123' - The same nonce is embedded in every allowed inline script tag:
<script nonce="abc123"> - The browser only executes inline scripts whose nonce attribute matches the one in the CSP header.
- A new nonce is generated for every request — it must never be reused.