CSP Generator
Build a Content-Security-Policy header directive-by-directive and evaluate it live for XSS bypasses (unsafe-inline, wildcards, missing object-src/base-uri). Supports strict-dynamic + nonce/hash, Report-Only, reporting endpoints, Nginx/Apache/meta output, and paste-to-audit. 100% client-side.
About CSP Generator
Build a Content-Security-Policy header directive-by-directive and evaluate it live for XSS bypasses (unsafe-inline, wildcards, missing object-src/base-uri). Supports strict-dynamic + nonce/hash, Report-Only, reporting endpoints, Nginx/Apache/meta output, and paste-to-audit. 100% client-side. Everything runs locally in your browser — your data never leaves your device.
How to use
- Enter your input in the tool above.
- Adjust any options to your preference.
- Use the Copy or Download buttons to save the result.
- Everything happens locally — your data never leaves your browser.
FAQ
What is a Content Security Policy (CSP)?
A Content Security Policy is an HTTP response header (or meta tag) that tells the browser which sources scripts, styles, images, fonts, frames and other resource types may load from. A well-built CSP is one of the most effective XSS mitigations available. It is defined per the W3C CSP Level 3 specification.
Why does this tool also evaluate the policy I built?
Because many 'CSP generators' ship policies that look complete but don't actually stop XSS — they allow 'unsafe-inline', broad wildcards like https:, or omit object-src/base-uri. This tool runs Google-CSP-Evaluator-style heuristics as you build, so you see XSS-bypass warnings the moment they appear, plus recommendations to move to nonce + strict-dynamic.
What is the strict-dynamic + nonce pattern and should I use it?
strict-dynamic (CSP3) lets a trusted script (loaded with a per-request nonce) load its own dependencies without an allowlist. It is the Google-recommended pattern because allowlist-based CSPs are routinely bypassed. This tool generates per-page nonces (base64, 128 bits) and SHA-256 hashes for inline scripts, with guidance for migrating off allowlists.
Does Report-Only mode and reporting work in this tool?
Yes. You can switch to Content-Security-Policy-Report-Only, configure report-to / report-uri endpoints, and the tool emits a Report-To header JSON object alongside the policy. Reports themselves are sent by browsers at runtime — this tool only builds the configuration; no report data ever reaches us.
What extras does this tool include?
(1) Live XSS-bypass evaluator with severity ratings. (2) Strict-CSP preset (nonce + strict-dynamic). (3) Per-directive plain-English docs. (4) Nginx, Apache, and HTML meta-tag output formats. (5) Report-Only toggle + report-to/report-uri config. (6) Paste-existing-CSP audit mode. (7) Nonce + SHA-256 hash generators for inline scripts. (8) Browser-support notes per directive (CSP2 vs CSP3). (9) Copy per output format. (10) Shareable URL encoding the policy config (no secrets — CSP is public). (11) Bypass-gadget detection for Angular/Prototype.js/JSONP. (12) Strict-CSP presets for SPA/SSR/static/API apps.
Which directives does this builder support?
All CSP3 fetch directives (default-src, script-src, style-src, img-src, font-src, connect-src, media-src, object-src, frame-src, child-src, worker-src, manifest-src, prefetch-src), plus frame-ancestors, base-uri, form-action, sandbox, upgrade-insecure-requests, require-trusted-types-for, trusted-types, report-uri, report-to, and the strict-dynamic / unsafe-hashes keywords.
Is my data sent anywhere?
No. Policy building, evaluation, nonce generation, and hashing all run in your browser. Shareable URLs encode the policy configuration in the fragment (#) which browsers do not transmit in HTTP requests. A CSP header is inherently public information — there are no secrets in it.
What does the bypass-gadget detector look for?
It flags known script-hosting sources that can be abused to bypass CSP when allowlisted in script-src: Angular on gstatic.com (via $eval), Prototype.js, JSONP endpoints on common CDNs (jsdelivr, cdnjs, gstatic), and data: URIs. For each gadget it suggests a safer alternative.
Related tools
.htaccess Generator
Generate Apache .htaccess rules: redirects (301/302), URL rewrites, auth, IP allow/deny, custom error pages, security headers, HTTPS force, www force, and 10+ extras. 100% private.
AES-256 Encryptor / Decryptor
Encrypt and decrypt text with AES-256-GCM via the Web Crypto API. PBKDF2 key derivation, salt + IV, and 10+ extras. 100% private — runs in your browser.
API Authentication Header Builder
Build API authentication headers: Bearer token, Basic Auth, API Key, HMAC, AWS Signature v4.