What is a CSP?
CSP stands for Content Security Policy. It is a browser security rule that tells a page which scripts, styles, images, fonts, and network connections are allowed to load.
ALT CSP Hash Generator
Define your base policy below, then drop HTML files to automatically append SHA-256 hashes for inline scripts and styles. Files are processed locally and never leave your browser. For production, prefer sending CSP as an HTTP header when your host supports it.
ALT CSP Hash Generator helps you create a Content Security Policy for static HTML pages that still use inline scripts or inline styles. Upload your HTML file, and the tool finds those inline blocks, creates SHA-256 CSP hashes for them, and adds the hashes to your script-src and style-src rules. It is useful when you want to reduce cross site scripting risk without rewriting a small site from scratch.
Base Policy Configuration
Drop .html files here or click to browse
Processes files locally. Max 50 files at a time.
Content Security Policy Questions
What does a CSP hash do?
A CSP hash lets the browser run one specific inline script or style block because its SHA-256 fingerprint matches the policy. If the code changes, the hash changes too, so unexpected inline code is blocked.
How can CSP help prevent cross site scripting?
A strict Content Security Policy can limit where scripts come from and block injected inline code. It is not a replacement for escaping user input, but it is a strong second layer when a page is attacked.
Should I use a CSP meta tag or a CSP header?
A CSP header is the better choice when your server or hosting platform supports it. A meta tag is helpful for static files, but some protections, including frame-ancestors, only work from an HTTP header.
Why are inline event handlers and style attributes flagged?
Hashes for script and style blocks do not automatically approve attributes like onclick or style. The safer fix is to move that code into a script file, stylesheet, or reviewed block that your policy can control.