Skip to content
Marvin's Toolbox.

CSP Builder

Build a Content-Security-Policy header directive by directive, or paste an existing policy to check it. Weak spots like unsafe-inline, wildcards and missing directives are flagged with what to do instead.

Runs entirely in your browser. Nothing you put in here gets uploaded.

Policy

Start from a preset

Everything from your own origin, images also from data: URLs.

  • default-src

    The fallback for every fetch directive the policy does not set.

  • img-src

    Images and favicons.

  • object-src

    Plugins loaded through object and embed. Almost always 'none'.

  • base-uri

    URLs a base element may set. Does not fall back to default-src.

  • form-action

    Where forms may submit to. Does not fall back to default-src.

  • frame-ancestors

    Who may embed this page in a frame. The modern X-Frame-Options.

  • upgrade-insecure-requests

    Loads every http:// resource over https:// instead.

    Takes no value. Listing it switches it on.

Output

The policy ready to deploy. Report-Only logs violations without blocking anything, a safe way to try a policy on a live site.

Format
Directives
7
Header size
147 B

Findings

Checks in the spirit of Google's CSP Evaluator, worst first, each with a concrete fix.

No serious weaknesses found

Every check passed.

High
0
Medium
0
Low
0
Info
0

Next steps

Keep going. These tools open with your result loaded in.

Text Case Converter

Convert text into every case at once: title case in the APA, AP, Chicago, MLA, Bluebook, AMA and NYT styles, sentence case, upper, lower, camelCase, snake_case, kebab-case and more.

textconverter

Word & Character Counter

Count words, characters, sentences, paragraphs, lines and more as you type, with estimated reading and speaking time.

text

Dedupe Lines

Remove duplicate lines from a list or text, keeping the first occurrence. Optionally ignore case and whitespace, or drop blank lines too.

textdev

Find and Replace

Replace text in two modes: plain find and replace all, or regular expressions with flag controls and capture group references like $1.

textdev

Text Diff

Compare two texts and see every added, removed and changed line highlighted, side by side or inline, with the changed words marked within each line. Ignore case, whitespace or blank lines, read a summary of how much changed, and export the result as a unified diff.

textdev

UUID Decoder

Paste a UUID to see what it carries: version, variant, and for time-based versions the exact timestamp, clock sequence and node. Also shows the raw bytes, the 128-bit integer and the URN form.

devuuid

Base64 Encoder & Decoder

Decode Base64 to text or encode text to Base64. Paste into the top box, read the result below, and flip the direction with one click. Handles Unicode correctly, reads URL-safe Base64, and shows binary payloads as a hex dump you can download.

devconvertertext

Number Base Converter

Convert numbers between binary, octal, decimal, hexadecimal and any base up to 36. Type into any field and the others update as you go. Handles huge integers without losing precision and accepts 0x, 0b and 0o prefixes.

devconvertercalculator

Scientific Notation Converter

Convert between scientific notation and full numbers as you type. Reads 1.23e5, 1.23 × 10^5 and plain numbers, shows the value written out, in normalized scientific notation and in engineering notation, and can round to any number of significant digits.

convertercalculator

About the CSP Builder Tool

This tool builds a Content-Security-Policy header directive by directive and checks it as you go. Start from a preset, switch keywords like 'self', 'none' or 'strict-dynamic' on and off, add hosts, nonces and hashes, and the finished header updates with every change.

Paste a policy you already have in the Evaluate tab to check it. It reads a bare policy, a full header line, a meta tag or an nginx or Apache config line. Every weak spot is listed with its severity and a concrete fix, and the mechanical fixes apply with one click.

What you can do

  • Generate a Content-Security-Policy header for a static site, a single-page app or an API
  • Build a strict nonce-based CSP with 'strict-dynamic'
  • Check an existing CSP for unsafe-inline, unsafe-eval and wildcard sources
  • Find missing object-src, base-uri and frame-ancestors directives
  • Calculate the sha256 hash of an inline script for script-src
  • Turn a CSP into an nginx add_header, Apache Header set or Next.js headers config
  • Create a CSP meta tag or a Content-Security-Policy-Report-Only header
  • Spot deprecated directives like report-uri and block-all-mixed-content

How to use the CSP Builder

  1. 1Pick a preset that matches your site, or paste your current policy into the Evaluate tab and open it in the builder.
  2. 2Adjust each directive. Toggle keywords, type hosts into the field and add a nonce or the hash of an inline script where you need one.
  3. 3Read the findings from the top. Fix the high ones first, either with the Apply fix button or by changing the directive yourself.
  4. 4Pick the format for your server and turn on Report-Only if you want to watch the policy on a live site before it blocks anything.
  5. 5Copy the header or the config snippet into your server.

What the checks look for

The checks follow the ideas behind Google's CSP Evaluator. Script control matters most, so 'unsafe-inline' without a nonce or hash, 'unsafe-eval', the * wildcard and broad schemes like https: or data: in script-src all count as serious. Allowlisted hosts such as public CDNs are flagged too, because they often serve JSONP endpoints or old libraries an attacker can load to run code despite the policy.

The checks also follow fallbacks the way a browser does. A missing script-src uses default-src, while base-uri, form-action and frame-ancestors never fall back, so leaving them out leaves those doors open even under a tight default-src.

Nonces, hashes and strict-dynamic

A nonce is a random value your server generates for each response and puts both in the header and on every script tag. A hash is the base64 SHA digest of an inline script's exact text, which suits static pages where the script never changes. The Hash Generator covers other digests.

With a nonce or hash plus 'strict-dynamic', modern browsers trust only the scripts you marked and whatever those scripts load, and ignore host lists and 'unsafe-inline'. That is why the strict preset still lists https: and 'unsafe-inline': they only apply to old browsers that do not understand the rest.

Header or meta tag

Send the policy as a response header where you can. A meta tag cannot carry frame-ancestors, report-uri or sandbox, and a Report-Only policy does not work in one at all. The output notes tell you which parts of your policy a meta tag would drop.

Related tools

Tools that share a tag with this one.

Bcrypt & Argon2 Generator

Hash a password with bcrypt or Argon2 and verify a password against an existing hash. Tune the cost factor, memory, iterations and parallelism, see how long the hash takes, and read the parsed parts of any hash you paste.

securitydev

Checksum Validator

Verify a checksum online: drop a file, paste the expected checksum and see instantly whether they match. The hash type is detected from the checksum itself, covering MD5, SHA-1, SHA-256, SHA-512, BLAKE3, CRC-32 and more, and sha256sum lines or whole checksum files can be pasted as-is.

devsecurity

CSR Generator

Create a certificate signing request with a fresh RSA or ECDSA key or your own. Fill in the subject and subject alternative names, then download the CSR and private key as PEM, with the matching openssl command alongside.

securitydev

Email Header Analyzer

Paste raw email headers to trace the Received chain hop by hop with per-hop delays, read the SPF, DKIM and DMARC results, and see every header explained. Helps you spot spoofing and find where a slow email got stuck.

devsecurity

Hash Generator

Hash text or a file with MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE2, BLAKE3, CRC32 and more, all computed live as you type. Compare against an expected checksum and copy any digest.

devsecurity

Invisible Character Revealer

Reveal the characters you can't see in a text: zero-width spaces, non-breaking spaces, bidi marks, control characters and CRLF versus LF line endings. Inspect every occurrence and clean them out with a click.

textdevsecurity