Online Content-Security-Policy (CSP) generator and parser with common directives, security warnings and normalized header output. All processing runs locally in your browser.
Directive list
CSP output
Common sources: 'self' /
https: /
data: /
blob: /
'none' /
'unsafe-inline' /
'nonce-...' /
'sha256-...'
How to Use
How to Use
- Generator Mode: Click 'Add directive' to build a CSP, with common sources supported.
- Parser Mode: Paste an existing CSP Header to parse and validate it.
- Click 'Copy CSP' to get the normalized Content-Security-Policy string.
- You can apply parsed results back to the Generator for editing.
Hints / risks
- CSP (Content Security Policy) is crucial for preventing XSS attacks.
- Avoid using 'unsafe-inline' and 'unsafe-eval' whenever possible.
- This tool runs entirely locally; your CSP config is not uploaded.
