CSP & SRI Hash Generator (Content-Security-Policy / integrity)
Generate the SRI integrity value and a ready-to-paste <script> / <link> tag from a script or CSS file, and assemble a Content-Security-Policy one directive at a time. To audit headers you already serve, use the HTTP Header Analyzer.
🔒 Runs in your browser · Your data is never sent to a server
SRI (integrity) hash
Choose a JS or CSS file, or drag & drop it here (up to 64 MB).
CSP (Content-Security-Policy)
Allowed sources per directive
Checks
How to use
- For SRI, pick a JS or CSS file under "Calculate from a file" (or paste the text), enter the URL for the tag, and copy the integrity value or the HTML tag.
- For CSP, choose the closest "Preset" and adjust the sources for each directive.
- Review the "Checks", and try "Report-Only (report violations without blocking)" before enforcing the policy in production.
- Pick an "Output format", press "Copy", and paste it into your server config or HTML.
Notes
- An SRI hash stops matching if even one byte of the file differs. Pasted text can end up with different line endings or a different trailing newline than the original file, so choose the file itself whenever you can.
- For a file on another origin such as a CDN, the server must send CORS headers (Access-Control-Allow-Origin). The tags this tool outputs include the crossorigin attribute set to anonymous.
- This tool does not fetch external URLs. Download the CDN file and select it, or paste its contents.
- A strict CSP can break inline scripts, social embeds, analytics tags and more. Try Report-Only first and check the violations in your browser developer console.
- A nonce (a value that changes on every request) must be generated on the server. On a static site you can add script hashes ('sha256-…') to the sources instead.
- The output is a starting template. Adjust it to the resources your site really loads and test the site after applying it.
Glossary
CSP (Content-Security-Policy)
A policy the server sends to declare which images, scripts and connections a page may use. The browser blocks anything from an unexpected source, which limits the damage of XSS (script injection).
SRI (Subresource Integrity)
The integrity attribute on a script or link holds a hash, and the browser checks that the fetched file matches it. It protects you if a CDN is compromised.
nonce
A random value generated per request. Putting the same value in the CSP and on a script tag allows only that tag to run.
FAQ
Which should I choose: sha256, sha384 or sha512?
All three are supported by browsers. sha384 is the most commonly used choice, so pick it if unsure. If you select several, they are listed space-separated in the integrity attribute and the browser verifies with the strongest one.
I added SRI and now the script does not load.
Either the file differs from the one you hashed by even one byte, or a cross-origin file is not served with CORS. Check that the CDN has not updated the file, that crossorigin="anonymous" is present, and that the host returns Access-Control-Allow-Origin.
Parts of my site broke after I set a CSP.
Inline scripts and external analytics, ad or embed tags are probably being blocked as loads from sources you did not allow. Deploy with "Report-Only (report violations without blocking)" first, read the violation messages in the browser developer console, and add only the sources you actually need.
Should I use a meta tag or an HTTP header?
An HTTP header is recommended. A meta tag ignores frame-ancestors, cannot be Report-Only, and does not affect resources loaded before the tag. On static hosting where you cannot change server config, the meta tag is the next best option.
Can I just enter a CDN URL to get its hash?
No. This tool processes data in your browser and never sends it anywhere, so it does not fetch URLs. Download the CDN file and select it, or paste its contents.
Share this page