Inline CSP Hash Source Builder

How to use Inline CSP Hash Source Builder

Extract selected inline HTML script and style text, then export exact UTF-8 hash sources with parsed-content evidence. Prepare reviewable hash lists from actual local HTML source instead of hashing a serialized element or guessing its whitespace. The tool keeps the normalized child text and original source intervals explicit. It never mounts your HTML, executes your scripts, loads resources or changes a security policy.

1. Provide optional utf-8 html source, original html source.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• One well-formed UTF-8 HTML source up to 100,000 bytes. A file takes precedence over pasted text; invalid UTF-8 or unpaired surrogate source is refused. This is HTML parsing with scripting enabled, not XML, a browser encoding detector or a live document inspection.
• The selected parse5 parser is loaded before a same-origin Worker reports ready within 10 seconds. A separate 2-second deadline covers parsing, traversal and hashing. At most 20,000 parsed nodes, 60 levels and 100 script/style elements including ignored ones are allowed; parsed inline text is at most 100,000 UTF-8 bytes. Node/depth bounds are checked after parsing inside that bounded Worker.
• Hashes use the parsed element child text encoded as UTF-8. HTML CRLF and CR become LF, NUL handling depends on parser context, and character references are not decoded inside script/style raw text. One initial UTF-8-source BOM is removed; a BOM inside an element remains. Neither raw file bytes nor outerHTML/serialized HTML is substituted for this text.
• Selected elements are plain HTML classic/module script without a src attribute and CSS style with absent, empty or exact ASCII-case-insensitive text/css type. Script MIME/language/type classification follows the selected HTML rules; for example spaces around module do not receive the classic-MIME whitespace exception. Empty scripts, data/special script types, template contents and foreign-namespace contexts are reported as ignored.
• Only script-src-elem and style-src-elem hash source lists are exported. This is a partial list, not a complete CSP policy or proof that code is safe. Event/style attributes, external resources, import maps, speculation rules, dynamic source, named/media/nomodule behavior, existing policy composition and actual delivery require separate review. No URL is followed.
• The report and Detailed JSON retain the exact parsed inline source text for review and can contain private code. Original offsets are zero-based half-open UTF-16 positions, not byte locations. Up to 100 parser-error records are kept as codes/line/column; parse recovery is not full HTML validation. Output text is capped at 500,000 characters.
• Real browser CSP allow/block fixtures and integration checks remain necessary. Browser execution, compatibility, host headers, third-party modifications, Trusted Types, access control, overall security and accessibility are not certified by generating hashes. No supplied source or generated policy is applied to this site.
• Structured text output is limited to 500,000 characters. Reduce the supplied source when that separate output budget is exceeded.
• Inputs are processed on this device and are not automatically saved or uploaded.