CSP Nonce Generator

Generate a CSP nonce

A nonce is a random, single-use value that lets a Content Security Policy allow one specific inline script to run while still blocking all other inline scripts. This generator produces a cryptographically random nonce, encoded in base64, along with examples of how to use it in the script-src directive of your CSP header and in the matching script tag. Only scripts carrying the exact nonce value will execute.

Crucially, a fresh nonce must be generated for every page request, so this tool is for understanding and testing the format rather than hard-coding a value.

Nonces versus unsafe-inline

Allowing inline scripts with unsafe-inline in a CSP effectively disables the policy main protection against cross-site scripting. Nonces solve this: by generating a new random value per request and attaching it to your legitimate inline scripts, you keep the strong protection while still permitting the specific scripts you control. An attacker cannot guess the unpredictable nonce, so injected scripts without it are blocked.

Generate the nonce server-side on each request and insert it into both the CSP header and the trusted script tags. The browser random generator is used here where available for genuine unpredictability. All generation happens locally in your browser.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.