How to use
- CSP header value
Paste a CSP
- List of findingsEach marked with a weight
Rank the weak points
- Improved policynginx and Next.js settings
Output a better policy
In the Evaluate tab, paste the value of the Content-Security-Policy header your server sends, a meta tag, or a Report-Only value. “Try a sample” also works.
Go through the findings from high to low. The suggested policy can change how a page behaves, so check the page and its features after you copy it.
In the Generate tab, pick a template and add the domains you need. Copy the output for your setup: HTTP header, meta, nginx, Apache, Next.js or helmet.
In the Hash tab, paste the exact body of an inline script or style to get its sha256, sha384 and sha512 values.
In the Violation reports tab, paste the JSON collected through report-uri or the Reporting API to see what was blocked, by which directive and where.
What it does
Ranked findings and a suggested policy
Findings for script-src, object-src, base-uri and more are grouped as high, medium, low and info. The analysis follows the default-src fallback, script-src-elem and script-src-attr overrides, and how unsafe-inline is treated when a nonce or hash is present. The suggestion removes unsafe values such as unsafe-eval and * from script-src, and adds missing defaults (default-src, object-src, base-uri and others).
Templates and six output formats
Start from a static site, an SPA, a strict nonce policy, Google Analytics, AdSense or YouTube. Output formats: HTTP header, meta tag, nginx add_header, Apache Header, Next.js headers() and helmet.
Hash calculation
Computes the sha256, sha384 and sha512 source values for an inline script or style, using the browser’s Web Crypto API.
Violation report reader
Reads report-uri JSON and the Reporting API format into a table of blocked URLs, directives and locations, with a count per directive.
Use cases
- Find out which directive blocked something after adding a CSP and broke the page
- Learn how to replace unsafe-inline and unsafe-eval with nonces or hashes
- Write the Content-Security-Policy line for Nginx or Next.js for your site
- Check which domains a site with ads, analytics or video embeds needs to allow
- Read violation reports from a Report-Only trial before enforcing the policy
Supported formats
Input
Capability matrix
| Feature | Support | Notes |
|---|---|---|
| Directive parsing and ranked findings | Supported | — |
| Suggested policy | Partial | Can change behaviour, so review it before use |
| Generate HTTP header, meta, nginx, Apache, Next.js and helmet | Supported | — |
| sha256, sha384 and sha512 hashes | Supported | — |
| Violation report reading | Supported | — |
| Fetch the live CSP from a site | Not supported | Entering a URL does not fetch anything; paste the header |
| Guaranteed identical behaviour in every browser | Not supported | Findings are guidance based on the specification |
| Same results as Google’s CSP Evaluator | Not supported | Checks are an independent implementation inspired by it |
Limits & notes
- The checks are an independent implementation inspired by Google’s CSP Evaluator (https://csp-evaluator.withgoogle.com/). They are not the same and results can differ.
- Hosts that are easy to bypass through JSONP or AngularJS use a selection of the public data in Google’s CSP Evaluator (https://github.com/google/csp-evaluator, allowlist_bypasses, retrieved 2026-10-16). A host not on that list cannot be judged.
- Wildcards over a top-level domain or a suffix anyone can register under (for example *.com, *.co.uk, *.github.io, *.vercel.app) use a representative selection from the Public Suffix List (https://publicsuffix.org/list/, retrieved 2026-10-16). A suffix not on that list cannot be judged.
- Findings are guidance. Check that ads, embeds and analytics still work on the real page after a change.
- In a meta tag, frame-ancestors, report-uri and sandbox are ignored, and Report-Only is not supported.
- Input limits: 20,000 characters for a policy, 1 MB for reports, and 1 MB for text to hash.
- Template domains are examples. Services change their domains over time.
- Works on phones too, but PC is recommended for long policies and large violation reports.
Privacy & safety
The CSP, scripts and reports you paste are processed only in your browser. Nothing is sent to or stored on a server.
FAQ
How do I run inline scripts without unsafe-inline?
What is strict-dynamic?
Should I use a meta tag or an HTTP header?
How do I test without breaking the site?
Can I keep the nonce placeholder in the output?
Related tools
robots.txt Tester
Paste a robots.txt to see instantly whether a URL is allowed or blocked for Googlebot or AI crawlers, and which line decided it. Misspellings and directives Google ignores are flagged too.
Mail Header Analyzer
Paste Gmail’s “Show original” or the headers of an .eml file to get the delivery route in time order, authentication results and mismatches with the From domain. Everything runs in your browser; no DNS, WHOIS or IP location lookups are made.
Secret Scanner
Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.
curl Converter
Paste “Copy as cURL” from Chrome or Firefox to see the method, URL, headers, cookies and body in tables, then convert to 12 kinds of code. The request is never sent and everything runs in your browser. Authorization and cookies can be hidden before you share.
Cookie / Set-Cookie Studio
Paste a Cookie header or Set-Cookie lines to see each attribute (Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite, Partitioned) in a table, with points to check. The form also builds a Set-Cookie header and framework code.
HTML Inspector
Paste a page’s HTML to review SEO and accessibility basics at a glance: heading structure, meta tags, Open Graph, image alt text, links and structured data — with a preview of how it may look in search and on social media.
Last updated: