Whitespace and newlines matter?

Yes — the browser hashes the literal bytes of the element. A trailing newline or a different indentation will invalidate the hash. Paste exactly what's between the tags.

Should I always use sha512?

No. sha256 is the de-facto baseline; sha384/sha512 are only required if your policy or auditor specifies them. Longer digests don't add real security here — the threat model assumes the inline content is what you authored.

CSP Hash Generator

Paste the exact contents of an inline script or style (no <script> tags, no leading/trailing whitespace differences) and the tool computes the SHA-2 digest over its UTF-8 bytes, base64-encodes it, and emits the 'sha256-…' style token that CSP accepts as a whitelist entry. The browser hashes the same way at parse time, so any byte mismatch — including line endings — will fail to match and the block will not execute. Use this instead of 'unsafe-inline' when you really do need a tiny inline snippet.

—

Inline script or style body

Algorithm

Target directive

Paste something to hash.

The browser hashes the exact bytes of the inline element. Whitespace, indentation, and line endings all count.

How to use

Paste the script body (everything between <script> and </script>) or the style body.
Pick the algorithm (sha256 is enough for almost everyone; 384/512 if your policy mandates them).
Copy the resulting 'sha256-…' token into the right -src directive.

Frequently asked questions

Whitespace and newlines matter?: Yes — the browser hashes the literal bytes of the element. A trailing newline or a different indentation will invalidate the hash. Paste exactly what's between the tags.
Should I always use sha512?: No. sha256 is the de-facto baseline; sha384/sha512 are only required if your policy or auditor specifies them. Longer digests don't add real security here — the threat model assumes the inline content is what you authored.

Related tools

Content-Security-Policy Builder

Build a CSP header from per-directive source lists, with three starter presets and live warnings for the dangerous wildcards.

Network 0 0

Hash Generator (SHA)

Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text.

Developer 0 0

File Hash (Checksum)

Compute SHA-1, SHA-256, and SHA-512 checksums of any file.

File 0 0

File Hash Verifier

Drop a file and paste an expected SHA-1 / 256 / 384 / 512 — see if the actual hash matches. Useful before installing downloaded binaries.

File 0 0

SPF Record Builder

Compose a Sender Policy Framework TXT record from mechanisms, IPs and includes — with a live DNS-lookup counter and warnings.

Network 0 0

Permissions-Policy Header Builder

Build the `Permissions-Policy` response header — toggle camera, microphone, geolocation, payment, fullscreen and 20+ other browser features by origin allowlist.

Network 0 0