Free tool
CSP and SRI hash generator
Hash an inline script or style to allow it by name in script-src or style-src, or hash a file to pin it with an integrity attribute. All three SHA-2 lengths, in both spellings.
Text you paste and files you choose are hashed in this page with your browser's built-in Web Crypto, and are not uploaded. Enter a URL and press Fetch and hash, and that URL goes to HeaderHawk, which fetches the file and hashes what the server sent. There is no account to make either way.
A hash covers every character between the tags
A CSP hash is taken over the exact text between <script> and </script>, including the line break after the opening tag, the indentation and the trailing newline. If a minifier, a template engine or an editor changes one character, the hash no longer matches, the browser blocks the script, and the console reports a policy violation with nothing pointing at the changed character. Paste exactly what the page serves.
Inline script or style
For a 'sha256-…' source expression. Paste the element's contents, without the tags.
Nothing to hash yet. Paste the contents of an inline script or style.
Hashing 42 bytes of UTF-8.
- sha256
'sha256-kGUQiECb7HTB3+cdt9SV9OGtiju37vTHScB5TlU3tzo=' - sha384
'sha384-a0NTU0D9ADFbRJlHpr8ybM7699mZJ0KPaJQRO7eT0QXSap2vVOxxCOf4DACJZZKf' - sha512
'sha512-tG+wH+ECWjQjdxaEXoc5WR+B7/qDU0xDcALZ4h3m9pi859xCh7yBtBoWLHrYCucw8Ihn0rGQGbZEfoPNTNMOQg=='
In a policy, beside whatever else the directive allows:
script-src 'self' 'sha256-kGUQiECb7HTB3+cdt9SV9OGtiju37vTHScB5TlU3tzo='Any one of the three is enough, and sha256 is the usual choice. A hash allows an inline <script> or <style> element, not an onclick attribute. Those need 'unsafe-hashes' as well, or better, a move into a script file.
A file from a CDN
For an integrity attribute. The hash must match the bytes the server sends, so Fetch and hash below is the surest: HeaderHawk requests the URL and hashes the response. A copy on your disk is next best. Pasting is last, because it converts Windows line endings and can drop a final newline, and either changes the hash.
Read in the browser. It is not uploaded.
This URL is sent to HeaderHawk, which fetches it once and hashes the response. Nothing about the fetch is stored.
Fetch a URL, or choose or paste a file, to get its integrity values.
- sha256
- sha384
- sha512
The complete tag
Keep crossorigin="anonymous". A browser can only check the integrity of a cross-origin file it fetched with CORS, and without the attribute it does not use CORS. It refuses the file and the console blames the hash. The server must also answer with Access-Control-Allow-Origin, and so must every redirect on the way. Most major public CDNs do, and Fetch and hash checks each response and names the one that would block it.
What this cannot tell you
Fetch and hash reads the file as it is served now, from HeaderHawk's network and not yours, so a host that answers differently by region or client can still surprise you. Text and files are hashed as given, and nothing checks that your page serves the same. It reads one URL, not every script on a page. And a hash needs replacing whenever what it covers changes: the next release of the file, or the next edit to the inline script. When a hash stops matching in production, the browser's violation report is where it shows up first.
Know when a hash stops matching
A report-only policy with HeaderHawk as its reporting endpoint turns a blocked script into a grouped violation with the page, the directive and the script sample behind it. Free for 1 site.