Content Security Policy Builder

Free Content Security Policy Builder that works offline

Draft a CSP from explicit source lists and copy either the header value or a report-only header example.

What this content security policy builder does

CSP reduces the impact of content injection by restricting where resources may load from. A safe production policy usually requires testing, reporting and gradual tightening.

How to use the Content Security Policy Builder

1. Paste or enter allowed source expressions for common CSP directives.
2. Adjust the available options for the result you need.
3. Choose Build policy and review the output before using it.
4. Copy or download the result, then clear the page if the input was sensitive.

Common uses

• Preparing Content Security Policy for development and testing
• Inspecting copied data without sending it to a remote service
• Creating reusable examples for documentation or local projects
• Completing a browser-based workflow while offline

Private processing and offline access

This tool does not submit your input to a conversion server. Processing takes place inside the browser using local JavaScript and standard Web APIs. After the PWA has been installed or cached, the page and its core features remain available without an internet connection. Closing or clearing the page removes unsaved input; the tool does not create an account or cloud history.

Tips for accurate results

• Start with Content-Security-Policy-Report-Only on an existing site.
• Avoid unsafe-inline and unsafe-eval unless a migration plan requires them temporarily.
• Do not add domains merely to silence errors; confirm why each source is necessary.

Frequently asked questions