Pure ToolsPure Tools
ToolsSitemapGitHubReport Issue中文

© 2026 Pure Tools. Crafted with precision.

Privacy

Free Online CSP Generator - ATools

Free online Content Security Policy generator with security analysis, real-time preview, and validation features.

Edit this tool
Professional developer's essential free CSP (Content Security Policy) generation tool - ATools - Generate secure CSP headers with real-time security analysis, XSS protection recommendations, and validation. Support all CSP directives including default-src, script-src, style-src, img-src, connect-src, font-src, media-src, frame-src, child-src, worker-src, manifest-src, object-src, base-uri, form-action, frame-ancestors, upgrade-insecure-requests, block-all-mixed-content. Interactive directive builder with syntax highlighting, security warnings for unsafe practices, one-click copy CSP header. Completely local generation, no server dependency, 100% protects policy security. Clean and intuitive interface, simple and efficient operation, is a professional tool for web security configuration and XSS protection. Completely free and open source, supports multiple common CSP formats, is the trusted security tool for global development teams!
Description: Content-Security-Policy is used to restrict resource loading and script execution to enhance XSS protection. It is recommended to use secure policies like `nonce-`/`sha256-`.
Tips/Risks
  • script-src contains 'unsafe-inline': Significantly reduces XSS protection capability (recommended: nonce/hash).
  • style-src contains 'unsafe-inline': Recommend using nonce/hash or avoiding inline styles.
Directive List
tokens:'self'
tokens:'self' · 'unsafe-inline'
tokens:'self' · 'unsafe-inline'
tokens:'self' · data:
tokens:'self' · data:
tokens:'self'
tokens:'none'
tokens:'self'
tokens:'self'
CSP Output
Common sources:'self' / https: / data: / blob: / 'none' / 'unsafe-inline' / 'nonce-...' / 'sha256-...'