Loading…
Build Content-Security-Policy headers. Use for XSS hardening. Input: directive options. Returns policy string. 100% client-side.
CSP Generator is loading — interactive editor will appear here. Use examples below to try instantly once loaded.
Press ? for keyboard shortcuts
A visual Content Security Policy builder that generates CSP headers through an interactive directive editor. Features include a nonce generator for inline scripts/styles, presets for common environments (Strict CSP, WordPress, React/SPA), toggling between meta tag and HTTP header output formats, report-uri/report-to configuration, directives search/filter, and download of the final policy as a text file.
CSP is one of the most effective defenses against XSS, but writing a correct policy manually is complex and error-prone. A visual builder helps developers craft policies that are both secure and functional by guiding them through each directive with clear descriptions.
This tool is part of the DevStackIO platform — a collection of free online developer tools from DevStackIO. Browse more free developer resources on DevStackIO.
Security engineers configuring web application defenses, full-stack developers deploying CSP, DevOps engineers adding security headers, and compliance teams documenting security controls.
Start with a preset (Strict, WordPress, React/SPA) or from scratch — directive editor lists all standard CSP directives
Add/remove directives using toggles — each has a description explaining what sources it controls
For each directive, specify allowed sources with autocomplete suggestions (self, domains, nonces, hashes, unsafe-inline, etc.)
Use nonce generator for cryptographically random nonces for inline script and style tags
Toggle between 'Meta Tag' and 'HTTP Header' — meta tags don't support frame-ancestors, sandbox, or report-to
Configure reporting with report-uri URL and optional report-to endpoint name
Download the completed policy as .txt or copy to clipboard — includes human-readable summary
Preset: React/SPA | Customize: Add GA => Output: "default-src 'self'; script-src 'self' https://www.googletagmanager.com 'nonce-abc123'; style-src 'self' 'nonce-abc123'; img-src 'self' https://www.google-analytics.com"Preset: Strict CSP | Meta Tag => Output: '<meta http-equiv="Content-Security-Policy" content="base-uri 'self'; default-src 'self'; script-src 'self' 'nonce-{NONCE}' 'strict-dynamic'">'report-uri vs report-to?
report-uri is older and widely supported. report-to uses the Reporting API and needs a Report-To header.
Can I use CSP with inline event handlers?
Blocked unless using 'unsafe-hashes'. Recommended: use addEventListener in nonced scripts.
Does the tool support CSP Level 3?
Yes, including 'strict-dynamic', 'unsafe-hashes', 'report-to', and worker-src.
What does 'strict-dynamic' do?
Allows scripts loaded by an already-trusted script to execute, eliminating the need to list every CDN.
Authoritative specifications, standards, and in-depth reading for CSP Generator.
Tool is loading — interactive editor will appear here. Use examples below to try instantly once loaded.
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text. Copy or compare instantly.
Generate time-based OTP codes from authenticator secret. Use for 2FA testing; for random tokens use token-generator. Input: Base32 secret. Returns 6-digit code + QR. 100% client-side.
Decode SSL certificates (subject/expiry/chain). Use for debugging certs. Input: PEM text ≤10MB. Returns parsed fields. 100% client-side.
Compute MD5/SHA-256/SHA-512 checksums for files to verify integrity. Use for files; for text strings use hash-generator. Input: file ≤10MB. Returns hex digests. 100% client-side, files never uploaded.
Infer JSON Schema from sample JSON for validation. Use when authoring schemas; for validating instances use json-validator. Input: JSON ≤10MB. Returns JSON Schema draft. 100% client-side.
Hash passwords with bcrypt (cost-configurable) and verify. Use for password storage; for fast checksums use hash-generator, for keyed MACs use hmac-generator. Input: password text. Returns bcrypt hash. 100% client-side.
Generate sortable ULIDs (time-ordered IDs). Use when ordering matters; for random UUIDs use uuid-generator, for tokens use token-generator. Input: count option. Returns ULID strings. 100% client-side.
Compute HMAC-SHA256/SHA512 for message authentication. Use for webhook signatures; for plain hashes use hash-generator. Input: message + secret key. Returns hex HMAC. 100% client-side.
Learn the concepts behind this tool.
Browse all glossary terms