Pure ToolsPure Tools
ToolsSitemapGitHubReport Issue中文

© 2026 Pure Tools. Crafted with precision.

Privacy·

Free Online CSP Generator - ATools

Free online Content Security Policy generator with security analysis, real-time preview, and validation features.

View source on GitHub
Professional developer's essential free CSP (Content Security Policy) generation tool - ATools - Generate secure CSP headers with real-time security analysis, XSS protection recommendations, and validation. Support all CSP directives including default-src, script-src, style-src, img-src, connect-src, font-src, media-src, frame-src, child-src, worker-src, manifest-src, object-src, base-uri, form-action, frame-ancestors, upgrade-insecure-requests, block-all-mixed-content. Interactive directive builder with syntax highlighting, security warnings for unsafe practices, one-click copy CSP header. Completely local generation, no server dependency, 100% protects policy security. Clean and intuitive interface, simple and efficient operation, is a professional tool for web security configuration and XSS protection. Completely free and open source, supports multiple common CSP formats, is the trusted security tool for global development teams!
Content-Security-Policy restricts resource loading and script execution to improve XSS defense. Using secure policies such as `nonce-`/`sha256-` is recommended.
Tips/Risks
  • script-src contains 'unsafe-inline': Significantly reduces XSS protection (recommend nonce/hash).
  • style-src contains 'unsafe-inline': Recommend using nonce/hash or avoiding inline styles.
Directive List
tokens: 'self'
tokens: 'self' · 'unsafe-inline'
tokens: 'self' · 'unsafe-inline'
tokens: 'self' · data:
tokens: 'self' · data:
tokens: 'self'
tokens: 'none'
tokens: 'self'
tokens: 'self'
CSP Output
Common sources: 'self' / https: / data: / blob: / 'none' / 'unsafe-inline' / 'nonce-...' / 'sha256-...'