Core tool
Generate a CSP you can paste into production.
Start with a safe baseline, ship in report-only mode first, then tighten directives as you verify real requests and remove unnecessary sources.
Policy inputs
The default fallback for resources. Most sites begin with
'self'.
Keep script sources explicit so you can tighten them later.
Nonce helper
Generate a base64 nonce and append it to script-src and style-src.
No nonce has been generated yet.
Inline script hash
Paste inline script content, compute its hash, and insert the expression into script-src.
'sha256-…'