Generate a CSP hash source for an inline script or style, or an SRI integrity value for a file. The tool runs on the site's own server, so it needs no Consepo account.
Hash pasted content
Under Hash tool, keep Pasted content, paste exactly the text between the tags, and choose Generate hashes. The result lists SHA-256, SHA-384 and SHA-512 as CSP sources, each with a Copy button.
Whitespace counts. A browser hashes the exact text, so a hash of the trimmed text never matches a script with a newline before or after the code, which is how WordPress prints inline scripts.
Content: alert('Hello, world.');SHA256: 'sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng='SHA384: 'sha384-H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO'Hash a file at a URL
Choose A file at a URL, enter an http or https URL, and choose Generate hashes. The server fetches the file (up to 2 MB, 15 seconds, three redirects) and hashes the bytes exactly as received. The result shows SRI values, recommends SHA-384, and gives a ready-made tag:
<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js" integrity="sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs" crossorigin="anonymous"></script>Two warnings can appear above the hashes:
- This host does not allow cross-origin checks. The response had no
Access-Control-Allow-Originfor the site, so a browser cannot verify an integrity hash for it and blocks the file instead. - This host changes its code behind the same URL. A pinned hash will break when the vendor next deploys; allow the host in the policy instead.
Fetches go through WordPress's safe HTTP API, which refuses private and local addresses other than the site's own.