---
title: Hash tool
---

Generate a CSP hash source for an inline script or style, or an SRI `integrity` value for a file. The tool runs on the site's own server, so it needs no Consepo account.

## Hash pasted content

Under **Hash tool**, keep **Pasted content**, paste exactly the text between the tags, and choose **Generate hashes**. The result lists SHA-256, SHA-384 and SHA-512 as CSP sources, each with a **Copy** button.

Whitespace counts. A browser hashes the exact text, so a hash of the trimmed text never matches a script with a newline before or after the code, which is how WordPress prints inline scripts.

<!-- wp:docspress/colorful-code {"language":"plaintext","filename":"Hash tool","code":"Content:  alert('Hello, world.');\nSHA256:   'sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng='\nSHA384:   'sha384-H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO'","highlightedLines":"","showLineNumbers":false,"caption":"The MDN example script. The plugin's unit tests check these values."} /-->

## Hash a file at a URL

Choose **A file at a URL**, enter an `http` or `https` URL, and choose **Generate hashes**. The server fetches the file (up to 2 MB, 15 seconds, three redirects) and hashes the bytes exactly as received. The result shows SRI values, recommends SHA-384, and gives a ready-made tag:

<!-- wp:docspress/colorful-code {"language":"html","filename":"Hash tool","code":"\u003cscript src=\u0022https://cdn.jsdelivr.net/npm/jquery@3.7.1/dist/jquery.min.js\u0022 integrity=\u0022sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs\u0022 crossorigin=\u0022anonymous\u0022\u003e\u003c/script\u003e","highlightedLines":"","showLineNumbers":false,"caption":"Generated for jQuery 3.7.1 on jsDelivr, and matching an independent openssl digest of the same file."} /-->

Two warnings can appear above the hashes:

- **This host does not allow cross-origin checks.** The response had no `Access-Control-Allow-Origin` for the site, so a browser cannot verify an integrity hash for it and blocks the file instead.
- **This host changes its code behind the same URL.** A pinned hash will break when the vendor next deploys; allow the host in the policy instead.

Fetches go through WordPress's safe HTTP API, which refuses private and local addresses other than the site's own.