Build a Content-Security-Policy header from individual directives, locally in your browser.
Enter space-separated sources for each directive you want to set (e.g. 'self' https://example.com). Leave a directive blank to omit it.
A correct CSP depends on your actual page's scripts, styles, images, and third-party embeds — test any policy with Content-Security-Policy-Report-Only before enforcing it, since an overly strict policy can silently break page functionality.
Copy this HTML to cite this tool from your own site or article.
CSP Builder assembles a Content-Security-Policy header value from individual directives you fill in, locally in your browser.
default-src 'self', img-src 'self' data: Result: default-src 'self'; img-src 'self' data:;
No. A correct CSP depends on your page's actual scripts, styles, and embeds — test it against your real site before enforcing it.
Both express the same policy. The HTTP header is generally preferred since some directives (like frame-ancestors) are ignored when set via a meta tag.
Security
Decode a PEM-encoded X.509 certificate to inspect its subject, issuer, validity dates, and public key details locally in your browser.
Converters
Convert a .env file of KEY=VALUE pairs to JSON or YAML.
DevOps
Combine common .gitignore snippets for languages and editors into one file.