Content Security Policy Generator
Start from a preset, then edit each directive. Replace {NONCE} with a fresh cryptographically random value generated per request — a reused nonce is no better than 'unsafe-inline'.
Fallback for anything not listed below.
Only scripts carrying the request's nonce, plus anything they load.
Inline styles are hard to remove; they cannot execute code.
XHR, fetch, WebSocket and EventSource targets.
Blocks the <object>/<embed> plugin bypass.
Stops an injected <base> retargeting every relative URL.
The modern replacement for X-Frame-Options.
Stops an injected form posting credentials elsewhere.
Content Security Policy Generator — Free Online Tool
Builds a Content-Security-Policy header from per-directive source lists, with presets for a strict nonce-based policy, a report-only rollout and a permissive starting point, warning about the combinations that silently defeat the policy such as unsafe-inline alongside a nonce, and emitting the header, a meta tag and an nginx add_header line.
How to use the Content Security Policy Generator
- Open the tool above — it runs entirely in your browser, so your input never leaves this page.
- Paste or type your input into the field, then press the relevant button (e.g. Encode / Decode, Generate, or Convert).
- Copy the result from the output area with the copy button orCtrl/Cmd + C.
- No signup, no upload, and no tracking — repeat as often as you need.
Frequently asked questions
Why does the tool warn about 'unsafe-inline' next to a nonce?
Because browsers that understand nonces ignore 'unsafe-inline' entirely. Keeping both only weakens the policy for older browsers while giving a false sense that inline scripts are still permitted in modern ones.
Why do I need object-src and base-uri?
They close two bypasses that a strict script-src alone does not. An injected <object> can execute content, and an injected <base> tag retargets every relative script URL to an attacker's host. object-src 'none' and base-uri 'self' cost nothing.
Should I start with report-only?
Almost always. Content-Security-Policy-Report-Only logs what the policy would have blocked without breaking the site, which is the only practical way to find the inline handlers and third-party scripts a real page depends on.
Free & private — why use this Content Security Policy Generator
The Content Security Policy Generator runs 100% client-side in your browser. Your data is never uploaded to a server, no account is required, and the tool is completely free. It works offline once the page has loaded and is part of a growing collection of privacy-first developer utilities.