Secure CSP Nonce Generator

You want unsafe-inline out of your script-src, but the page still carries a handful of inline scripts you cannot move today. The standard answer is a nonce: a random value that appears both in the header and on the tag, so only the scripts you marked are allowed to run. What usually stalls the work is the exact shape of the header and how much randomness is enough.

The value comes from the browser crypto.getRandomValues, a cryptographic generator rather than Math.random. The default is 16 bytes, 128 bits, which encode to 24 base64 characters. The field accepts 16 to 64 bytes and quietly clamps anything outside that window. The output shows the finished header and the script tag together, and both must carry the identical value or the browser blocks the script.

Here is the warning that matters most: a nonce copied off a web page and pasted into a static template protects nothing at all. It has to be drawn fresh for every HTTP response, on the server, and injected into the header and the HTML of that same request. Use this box to check the shape, build a curl test or write documentation. Note too that once a nonce is present, modern browsers ignore unsafe-inline.