Build a CSP header and spot directives that weaken browser protections.
Your policy stays in this browser. Nothing is sent to a server.
Presets are starting points. Add the exact origins, nonces, or hashes your application needs.
medium priority
Inline styles are allowed. This is common for some frameworks but still weakens style injection controls.
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests">
Meta-tag policies cannot use frame-ancestors, sandbox, report-uri, or report-to. Prefer an HTTP response header whenever possible.
PEM / Certificate Decoder
Inspect local X.509 certificates, validity, usages, SANs, and fingerprints.
Chmod Calculator
Toggle permissions or enter a number to see the chmod breakdown.
JWT Decoder
Decode JWT headers and payloads — no secret needed.
Secret / Token Generator
Generate cryptographically random secrets and tokens for API keys, JWT secrets, and more.