1. Use the right tag
Inline <script> blocks go into script-src.
Inline <style> blocks go into style-src.
Inline-code helper
Generate the hash for
Generate the hash for script-src or style-src.
Paste the exact inline script or stylesheet. The hash is computed in the browser using
SubtleCrypto, so nothing leaves the page. The output uses the same encoding as
openssl dgst -sha256 -binary | openssl base64 -A.
Source
Include the source exactly as it appears inside the <script> or
<style> tag — no leading or trailing whitespace unless it is part of the source.
SHA-256 is the most common; SHA-384 / SHA-512 offer no real security benefit for CSP.
The ready-to-paste directive includes the trailing quote exactly as CSP expects.
How to use the result
The hash is only valid if the source the browser receives is byte-for-byte identical.
2. Strip server-injected whitespace
HTML minifiers and servers sometimes change indentation, line endings, or add trailing newlines. If the hash fails, re-paste the source the browser actually receives and recompute.
3. Combine with nonce for trust
Hashes are great for static inline blocks you control. For dynamic content, prefer a per-request nonce via the CSP Generator.
Related reading
Conceptual background and rollout patterns.
Nonce vs hash
How to choose between a per-request nonce and a static hash for your inline content.
unsafe-inline explained
What unsafe-inline allows, why it weakens CSP, and how hashes replace it.
CSP Generator
Drop the hash into a full Content Security Policy with report-only, nonce, and platform export.
Script blocked by CSP
Diagnose the most common reasons an inline script is rejected after switching to hash-based CSP.
Debug CSP with Chrome DevTools
How to read the violation report and confirm the hash you are sending is the hash the browser computed.
Security headers best practices
How hashes fit into the broader rollout order for the security baseline.