script-src tools
Inline-script hash generator
Hash an inline script to allow it under script-src with 'sha256-...'. Everything runs locally in your browser. Nothing is sent anywhere.
Hash the exact bytes between your script tags (no attributes) to allow that inline script with 'sha256-...'. Any change to the script invalidates the hash.
Checking a full policy, not just one script? CentralCSP's CSP evaluator grades your entire header and flags known bypasses.
Nonce vs. hash: which should I use?
Use a nonce when your server renders pages dynamically and can emit a fresh random value on every response. Use a hash when the inline script is static and identical on every load. A hash needs no per-request server logic, but it breaks the moment the script's bytes change.