Web

CSP Builder

Draft a Content Security Policy without memorizing every directive. Start from practical defaults, edit allowed sources and copy an enforced or report-only header.

safe baseline

No broad sources or unsafe execution flags detected. Test in Report-Only mode before enforcing.

csp-header.txt
runtime

Browser-local execution

Inputs stay inside the current tab unless you copy, download or explicitly export.

memory

Session handoff

Magic Paste can pass input to a target tool through sessionStorage, never through the URL.

control

User-owned state

Favorites, recent tools and workflow history are local browser data you can clear from the browser.

smart handoff graph

Suggested next moves

session handoff ready
/web
HTTP Headers Inspector
Parse response headers and score common security headers.
/web
Magic Paste
Paste anything and get routed to the right local tool with confidence signals.
/web
cURL Converter
Turn copied cURL commands into fetch, Python requests and structured request JSON.
/web
Stack Trace Lens
Parse JavaScript, Python and generic stack traces into actionable frames and issue reports.
sponsor

Fixed native slots for developer products. No third-party tracking, no popups, no layout shift.

Sponsor this tool
01

How to use

  1. 01Edit each CSP directive source list.
  2. 02Toggle enforced or report-only mode.
  3. 03Copy the complete HTTP header.
02

FAQ

Should I deploy CSP directly in enforced mode?
Usually start with Report-Only in production, inspect violations, then enforce once legitimate resources are covered.
Does this validate every possible CSP directive?
No. It focuses on the directives most teams need first.
03

Related tools