Free CSP generator

Build a Content-Security-Policy header directive by directive, then paste an existing one to see what it is missing. Both the builder and the checker run on your device in plain JavaScript. Your policy names your CDNs and API hosts, and none of it is sent to a server.

How the CSP generator works

Set your sources

Start from the strict preset, then allow back the hosts your site really loads script, style, images, and API calls from.

Take the snippet

The header is assembled as you toggle, with copy-ready forms for the HTTP header, the meta tag, Nginx, and Apache. Deploy it report-only first.

Check what you have

Paste a live policy into the Check tab and every weak source and missing directive comes back ranked by severity with the fix.

Private by design: nothing leaves your browser

A Content Security Policy is a map of your infrastructure. It names your CDN, your API hosts, your payment provider, and every analytics vendor you have ever bolted on. That is a useful document for an attacker and it should not be uploaded to a stranger's server to be linted:

100% client-side

Building the header and parsing a pasted one are plain string operations in JavaScript. The nonce comes from crypto.getRandomValues, your browser's own secure generator. No network request carries your policy.

Nothing stored or logged

There is no account and no analytics on what you paste. Reload the page and the policy is gone from memory.

Your site is never fetched

The checker reads only the text you paste. It never requests your domain, so nothing about the check appears in your access logs or your WAF.

What a good policy does

script-src is where the security lives. A nonce or a hash on your inline scripts is what actually stops injected script from running.
object-src 'none' and base-uri 'none' close two attack paths that cost you nothing, because almost no site uses either feature.
frame-ancestors is what stops clickjacking, and it does not inherit from default-src, so leaving it out leaves you open.
Report-only mode lets you watch what a policy would break for a week or two before it breaks anything.

Built for developers and security-conscious teams

Anyone shipping a header that decides which code the browser will run on their site. BlockSurvey takes the same position on research data with zero-knowledge surveys, where responses are encrypted before they ever reach a server.

Frontend developers

Work out which directive is blocking your bundle, and get a policy that survives a script loader without falling back to 'unsafe-inline'.

Security & IT teams

Grade the CSP on a site you are reviewing, and hand the owner a finding list with a concrete fix rather than a score.

Teams heading into an audit

A CSP shows up in SOC 2 and pentest reports. Build one, ship it report-only, and close the finding before the assessor opens it.

Building something that handles sensitive data?

BlockSurvey runs on zero-knowledge surveys, so the responses you collect are never sold or mined. Responses are encrypted on the respondent's device, so the server stores nothing readable.

More free privacy tools

Browse all privacy tools

Secure password generator

Generate a strong random password, passphrase, or PIN in your browser with the Web Crypto API.

Encryption key generator

Generate AES-128, AES-192, and AES-256 keys or random secrets, entirely in your browser.

Encryption and decryption tool

Encrypt or decrypt text with AES-256-GCM. The message and passphrase never leave your browser.

Password strength checker

Check a password's real strength and entropy in bits, scored on your device and never sent anywhere.

PGP encryption tool

Encrypt, decrypt, and generate PGP keys. Keys and messages never leave your browser.

Hash generator

Generate MD5, SHA-256, HMAC, and bcrypt hashes, computed entirely on your device.

UUID generator

Generate UUID v4, v7, v1, or a GUID, one or a thousand at a time, entirely in your browser.

JWT decoder

Decode a JSON Web Token and verify its signature in your browser. The token and key never leave your device.

TOTP generator

Generate a live 6-digit 2FA code from a base32 secret, or create a secret to scan into your authenticator app.

Base64 encoder and decoder

Encode text to Base64 and decode it back to text or a file, with URL-safe and MIME options.

URL encoder and decoder

Percent-encode and decode URLs, and split any URL into its decoded query parameters.

Hex converter

Convert between text, hex, binary, decimal, ASCII, and Base64 in any direction, with a live byte table.

PII redactor

Redact emails, phone numbers, credit cards, SSNs, IBANs, IPs, and API keys from text you paste or drop in.

Answer a short form and get a GDPR and CCPA privacy policy as HTML, Word, or PDF.

Terms and conditions generator

Draft terms for a website, app, store, or SaaS and download them as HTML, Word, or PDF.

Cookie policy generator

Build a cookie policy with a real cookie table covering name, provider, purpose, type, and duration.

Disclaimer and EULA generator

Pick the clauses you need, from affiliate disclosure to warranty and liability, and export the document.

Secure QR code generator

Generate a QR code entirely in your browser. The link goes straight to your destination, not through a tracking redirect.

Email bounce checker

Check a list of email addresses for bounces and bring your bounce rate down before you send.

Image compression

Compress images in the browser to cut file size while keeping the quality you need.

These tools run in your browser because that is how we build everything. The same idea, applied to research: privacy-first surveys with end-to-end encryption.

Frequently asked questions

Is this CSP generator free?

Yes, free and with no sign-up. Both the builder and the header checker run in the page you are looking at, so there is no quota to hit.

Does the policy I paste get sent to a server?

No. The builder assembles the header string and the checker parses it with plain JavaScript in your browser. No request carries the policy, and a CSP often maps out your CDNs, API hosts, and analytics vendors, which is exactly the kind of infrastructure detail you should not hand to a random website.

What is a Content Security Policy?

It is an HTTP response header that tells the browser which sources of script, style, image, and other content it may load for your page. A correct CSP is the strongest defence against cross-site scripting, because even if an attacker injects a script tag, the browser refuses to execute it when the source is not on your allow list.

Which directives do I actually need?

Start with these five and add more only when something breaks. default-src sets the fallback for anything you do not name. script-src controls JavaScript and is where most of the security lives. object-src 'none' kills the plugin attack surface. base-uri 'none' stops an injected base tag from rewriting your relative URLs. frame-ancestors controls who may put your page in an iframe, which is what stops clickjacking.

Is 'unsafe-inline' ever acceptable in script-src?

In script-src it defeats most of the point of having a CSP, because injected inline script is the usual payload of a cross-site scripting attack. Use a nonce or a hash for the inline scripts you genuinely need. In style-src it is a much smaller risk and plenty of production sites keep it, though a nonce is still better if your framework can emit one.

Should I use the HTTP header or the meta tag?

Use the HTTP header wherever you control the server, because the meta tag ignores frame-ancestors, report-uri, report-to, and sandbox. The meta tag is a reasonable fallback for a static host where you cannot set headers, and this tool gives you both forms of the same policy.

How do I roll out a CSP without breaking my site?

Ship it in report-only mode first. Turn on the report-only toggle here, add a report-uri, and deploy. The browser will send you a violation report for everything the policy would have blocked without actually blocking it. Watch the reports for a week or two, widen the policy where the violations are legitimate, then switch the header to the enforcing name.

What is a nonce, and why does strict-dynamic need one?

A nonce is a random value your server generates per response and puts on both the CSP header and the script tags it trusts. The browser runs only the scripts carrying that nonce. strict-dynamic then says that any script loaded by an already-trusted script is trusted too, which lets a nonce survive script loaders and bundlers without listing every CDN. Generate the nonce fresh on every response. Reusing one across responses makes it worthless.

Can I use this offline?

Yes. Once the page has loaded you can disconnect and keep building or checking policies, because none of it needs the network.

Do you store the policy or header I paste in?

No. The directives you build or the header you paste to check are parsed entirely in your browser and never sent to a server. There is nothing to store because there is no backend call in the first place.

How is this different from a paid CSP tool?

Most paid header scanners run the check server-side, which means your header (and sometimes your source) leaves your machine to get an answer. This one builds and validates the policy client-side, with no sign-up and no per-scan limit.