CSP Generator

Compose Content-Security-Policy directives for your site in LocalKit. Draft CSP headers locally—policies stay in your browser with nothing uploaded for computation.

Interactive controls load with JavaScript. Processing stays in your browser—nothing is uploaded.

Loading tool…

How to use

  1. Open CSP Generator — Load the page.
  2. Select directives — Toggle sources you need.
  3. Generate header text — Copy Content-Security-Policy value.
  4. Deploy on your host — Apply via CDN/host headers.

Limits

Requires JavaScript. Extremely large inputs may slow the browser tab. Results depend on your browser APIs; there is no server-side processing quota because nothing is uploaded.

When to use

When you want a quick, free utility without creating an account or sending content to an online converter.

When not to use

When you need server-side integration, batch automation at scale, or certified compliance tooling.

Privacy note

Tool inputs are processed in your browser only. Theme, language and favorites may use localStorage; hosting may keep standard access logs (IP, UA, URL) without tool payloads.

FAQ（5）

Report-only?

You can draft Content-Security-Policy-Report-Only separately in your host config.

Nonce/hash?

Add nonces/hashes in your app; this tool helps compose directive text.

Uploaded?

No.

Breaks site?

Start in report-only, watch violations, then enforce.

Inline scripts?

Prefer nonces or hashes over 'unsafe-inline'.