100% local and secure
Your data stays on your device and is never sent to our servers.
CSP generator
Generate a readable CSP with presets, warnings, and output ready for an HTTP header or meta tag.
- 100% local
- Instant
- Free
- No account
- Works offline
- Clipboard
Preset
Generates a monitoring header that does not block resources.
Directives
Separate sources with spaces or commas.
HTTP header
Meta tag
Raw policy
Why use this tool?
Build a Content Security Policy to restrict the sources a browser may load. Generation stays local.
Smart processing
Generate or verify sensitive data with clear and immediate controls.
Supported formats
Strings, keys, hashes, and technical formats depending on the security function.
Save time
Get a clean, ready-to-use result in seconds without installing software or configuring a complex workflow.
Guide
How to use this tool
- 1
Choose a preset
Start with a strict, analytics, or permissive policy.
- 2
Adjust directives
Add only the domains and schemes your site needs.
- 3
Deploy carefully
Test with Report-Only before blocking resources.
Tips and best practices
- Start with default-src and specialize other directives.
- Avoid unsafe-inline, unsafe-eval, and wildcards when possible.
- A complete CSP must be tested across every page.
Frequently asked questions
What does a CSP do?
It helps reduce risks such as executing scripts or loading resources from unexpected sources.
Header or meta tag?
The HTTP header is preferred and supports more directives. A meta tag can help but has limitations.
Why use Report-Only?
It lets you observe violations before enforcing a blocking policy.
Was this tool useful?
Read next
GuideBest practicesBeginner
Content Security Policy (CSP): reduce XSS risks and unwanted loads
Learn how to introduce a CSP progressively, understand its main directives, Report-Only mode, nonces and common mistakes.
29 August 20261 minRead
GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 minRead
GuideBest practicesBeginner
HTTP security headers: which ones to enable and why
Understand HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy and how to verify the headers actually returned.
29 August 20261 minRead
GuideBest practicesBeginner
Hashes, integrity and fingerprint comparison: what a hash can really prove
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
29 August 20262 minRead
Recommended workflow
Continue your processing
Discover tools that naturally fit before, after, or alongside this one.
Complementary tools
Security & privacy
Security headers generator
Generate HTTP security headers for the protections you want to enable on your site.
100% local
Use this toolSecurity & privacy
AES Encrypt & Decrypt
Encrypt and decrypt text locally with AES-256-GCM and a password.
100% localNew
Use this toolSecurity & privacy
X.509 Certificate & CSR Inspector
Inspect an X.509 certificate or CSR in PEM format locally.
100% localNew
Use this tool