CSP Builder & Validator
Build a Content-Security-Policy visually, or audit an existing header
About this tool
CSP Builder & Validator runs entirely in your browser on DevTools — no signup, no upload.
What this tool does not do
- CSP Builder & Validator is a free in-browser utility, not a hosted API, and keeps no server-side history.
How to use this tool
Using CSP Builder & Validator
Open CSP Builder & Validator, enter or paste your input, and copy the result.
Related guides
Content-Security-Policy: Build It Right, Then Audit It
A practical guide to authoring a strong Content-Security-Policy and auditing one you already ship. How default-src, unsafe-inline, wildcards and frame-ancestors affect your real XSS protection.
HTTP Security Headers Explained: HSTS, CSP, and the Rest
A practical guide to response security headers. What HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy actually do, and the weak values to avoid.
Related tools
AES Encryption
Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.
Basic Auth Generator
Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.
BIP39 Mnemonic Generator
Generate and validate BIP39 seed phrases locally for testing
Checksum Calculator
Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API
Client-Side File Encryptor
Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.