CSP Generator
Build a Content-Security-Policy header and check an existing one.
A Policy That Actually Stops Injected Scripts
A Content Security Policy tells the browser which sources of script, style, images and other content a page may use, so a script injected through an XSS bug is refused. Build one directive by directive, starting from a strict nonce-based preset, a same-origin preset or common third-party additions, and copy it as an HTTP header, Apache or nginx configuration, or a meta tag.
Switch to the checker to audit a policy you already have. It applies the same rules as Google’s CSP Evaluator — flagging 'unsafe-inline' without nonces, 'unsafe-eval', wildcards, bypassable CDN allow-lists, a missing object-src 'none', base-uri or frame-ancestors, and unquoted keywords — ranked by severity.
Key features
- Directive-by-directive builder with presets.
- Evaluator with Google CSP Evaluator’s checks.
- SHA-256 hashes for inline scripts and styles.
- Header, Apache, nginx or meta output.
- Report-only mode for safe rollout.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: CSP Generator
- Start from a preset
Strict (nonce) is most robust; same-origin is simplest. - Adjust the directives
Add only the third-party hosts you really use. - Review the findings
High-severity items are real holes. - Deploy as report-only first
Watch for violations, then enforce.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Security |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
What is a Content Security Policy?
An HTTP response header that restricts where a page may load scripts, styles, images and other resources from. Its main job is to stop cross-site scripting: even if an attacker injects a script tag, the browser refuses to run it.
Why is unsafe-inline dangerous?
It allows any inline script to run — including one an attacker injects — which removes most of the protection. Use nonces or hashes so only your own inline scripts run.
What is a nonce?
A random value generated fresh for every response, placed in the CSP and in each of your script tags. An injected script cannot know it, so it is blocked. It must be unpredictable and never reused.
Why is allow-listing a CDN risky?
Public CDNs host thousands of libraries, including old versions with known CSP bypasses. Allowing the whole host lets an attacker load one of those. Nonces with strict-dynamic avoid the problem.
Can I set a CSP in a meta tag?
Yes, for most directives, but frame-ancestors, sandbox and reporting only work in the HTTP header. The meta output here leaves those out.