All tools

CSP Nonce Generator

Network

Generate a cryptographically random base64 nonce for a Content-Security-Policy script-src/style-src directive, with a ready-to-paste header snippet and matching <script nonce="...">/<style nonce="..."> tag.

The shipped CSP Header Builder only supports a nonce placeholder in its script-src/style-src output, since the real value has to be a fresh, unpredictable string generated on the server for every single response, never something you could type in by hand or reuse. This tool generates that actual value: a cryptographically random byte string, base64-encoded per the CSP spec, alongside the exact script-src and style-src directive text and the matching HTML script/style tag attribute. Use it to see the expected shape of a nonce while wiring up your server-side generation code, or to quickly hand-test a nonce-based policy locally. It is not a substitute for generating the nonce server-side per request in production, since a nonce reused across responses defeats its entire purpose.

cspsecurityheadersnoncecontent-security-policy

How to use CSP Nonce Generator

  • 1.Pick how many random bytes to use (16 bytes / 128 bits is the CSP spec's recommended minimum).
  • 2.Click Generate new nonce to produce a fresh cryptographically random value.
  • 3.Copy the header directive and the matching script/style tag, using the same nonce in both for a single response.

Frequently asked questions

Can I use the same nonce on multiple pages or requests?
No. A nonce only provides security if it is unguessable and unique per response. Reusing one across requests lets an attacker who observes it once bypass the policy on every future response that reuses it.
Does this generate the nonce server-side?
No, it runs entirely in your browser using the Web Crypto API for demonstration and local testing. In production, generate the nonce in your server-side request handler and inject it into both the response header and the HTML for that same request.
Why base64 and not hex or a plain random string?
The CSP spec requires the nonce-source to be a base64-encoded value; browsers do not accept other encodings for the nonce- directive syntax.
How is this different from the CSP Header Builder?
The CSP Header Builder assembles a full multi-directive policy from presets and only offers a nonce placeholder, since it has no way to generate a real per-request value. This tool generates the actual random nonce value and the small set of snippets that use it.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/csp-nonce-generator \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"byteLength":16}'

Get an API key from your dashboard · Full API docs →

Related tools

CSP Header BuilderBuild Content-Security-Policy headers with presets and validationNetworkPermissions-Policy Header BuilderBuild a Permissions-Policy (formerly Feature-Policy) response header from a list of browser features and their allowlists (self, none, specific origins, or all origins), with a plain-English note on what each directive restricts, or parse an existing headerNetworkReferrer-Policy Header BuilderBuild a Referrer-Policy header value from one or more policy tokens with a plain-English explanation of each and warnings for risky choices like unsafe-urlNetwork