Web Tools tools.bryantsmith.com

Security & Encoding

CSP Builder

Start from the policy that matches your site, then copy a ready-to-ship Content-Security-Policy as a header, meta tag, or nginx rule. Fine-tune every directive under Advanced — nothing leaves your browser.

Runs in your browser v1.0.0

1. Pick a starting policy

start here

Choose the situation that matches your site. The policy and its explanation update immediately — no account, no server.

2. Generated policy

live 



                    

                        

                            
                            
                        

                        

                            
                            
                        

                    


                    

                        Report-only sends violation reports without blocking. Meta tags cannot be report-only.
                    


                    


                    

                        
                        
                        
                        
                    


                    

                

            


            

                

                    
What each directive does

                

                

                    
    
                
    
            
    
        
    

        
    
            
                3. Advanced: edit directives
                optional
            
            
    
                
    
                    Each directive takes a space-separated source list. Leave a directive blank to omit it,
                    use 'none' to allow nothing, and quote keywords such as 'self'.
                
    

                
    

                
    
                    
    
                        
                        
                    
    
                    
    
                        
                    
    
                    
    
                
    
            
    
        
    
    
    

    
        
        
        
        
        
        
        
        
        
        
        
        
    

    
    
        
    
            
    How it works
    
        
    
        
    
            
    
                Pick a preset to load a known-good starting point with a short explanation of why it fits.
                Every directive is validated locally — unknown keywords and malformed sources are
                reported instead of silently emitted. Change the format to get an HTTP header line, just
                the policy value, an HTML meta tag, or an nginx add_header rule. The built
                policy is written to the URL fragment so it can be bookmarked or shared, and no input is
                ever sent to a server. For a staged rollout, tick Report-only so browsers
                report violations without blocking.
            
    
        
    
    
    

    

    Related tools
    • Base64 Encoder / DecoderEncode text or files to Base64, or decode Base64 back to text and files, entirely in your browser.
    • CSP AnalyzerPaste a Content-Security-Policy to flag risky, redundant, contradictory, and commonly misunderstood directives — entirely in your browser.
    • Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 hashes from text or a file — entirely in your browser.
    • HMAC GeneratorGenerate HMAC signatures from a message and secret key with SHA-256, SHA-512, SHA-384, SHA-1 or MD5 — entirely in your browser.
    • JWT DecoderDecode a JWT header and payload and inspect its claims locally — your token never leaves the browser.
    • JWT Expiration CalculatorPaste a JWT to see when it was issued, when it becomes valid, and exactly how long until it expires.
    More Security & Encoding tools