DevTools Logo

CSP Builder & Validator

CSP Builder & Validator

Build a Content-Security-Policy visually, or audit an existing header

Policy Mode

Log violations without blocking

Directives

default-src
1
script-src
1
style-src
1
img-src
2
font-src
1
connect-src
1
media-src
1
object-src
1
frame-src
1
frame-ancestors
1
base-uri
1
form-action
1
manifest-src
1
worker-src
1
prefetch-src
1

default-src

Default policy for all content types

'self'

    About this tool

    Build a Content-Security-Policy visually or audit an existing header for unsafe-inline, wildcards and missing directives. Get a risk score and fixes. Free, in-browser. CSP Builder & Validator runs in the browser on DevTools. There is no signup, and your input stays on this device unless the tool explicitly performs a live network lookup.

    What this tool does not do

    • CSP Builder & Validator is a free in-browser utility, not a hosted API. It does not keep server-side history and is not a substitute for production verification in your own stack.

    How do I use this tool?

    1. How do I use CSP Builder & Validator?

      Open CSP Builder & Validator, enter or paste your input, and copy the result. The page works without an account.

    Related guides

    Content-Security-Policy: Build It Right, Then Audit It

    A practical guide to authoring a strong Content-Security-Policy and auditing one you already ship. How default-src, unsafe-inline, wildcards and frame-ancestors affect your real XSS protection.

    HTTP Security Headers Explained: HSTS, CSP, and the Rest

    A practical guide to response security headers. What HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy actually do, and the weak values to avoid.

    Related tools

    AES Encryption

    Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.

    Basic Auth Generator

    Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.

    Bcrypt Generator & Verifier

    Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.

    BIP39 Mnemonic Generator

    Generate and validate BIP39 seed phrases locally for testing

    Checksum Calculator

    Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API

    Client-Side File Encryptor

    Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.