01
Security-focused presets
Start from strict, WordPress, API, static, or custom policy configurations.
Start typing to search 139 tools.
API Key GeneratorGeneratorGenerate secure API keys with configurable length, prefix, quantity, and URL-safe, hexadecimal, Base32, or alphanumeric formats.→Alternating Case ConverterTextConvert ordinary text into alternating uppercase and lowercase letters while preserving spaces, punctuation, numbers, and line breaks.→BCrypt Hash GeneratorGeneratorUse this free BCrypt Hash Generator to create a salted password hash with a configurable cost and copy it for secure password-storage testing.→BCrypt VerifyValidatorVerify a plain-text password against a BCrypt hash safely, understand match results, and troubleshoot invalid hash formats without attempting to decode the hash.→Base64 DecoderEncode DecodeDecode Base64 into readable Unicode text for debugging, data recovery, API checks, configuration review, and development work→Base64 EncoderEncode DecodeEncode Unicode text as Base64 for data transport, API payloads, configuration values, testing, and development tasks→CRC32 GeneratorGeneratorGenerate CRC32 checksums from exact text in hexadecimal and decimal formats for compatibility checks, fixtures, archives, and data-transfer testing.→CSP Policy BuilderGeneratorBuild a Content Security Policy header with source directives, reporting, nonce and security options.→CSS BeautifierDeveloperUse CSS Beautifier to format compressed or inconsistent CSS online with readable indentation, line breaks, declarations, selectors, comments, and nested blocks.→CSS MinifierDeveloperMinify CSS by removing unnecessary spaces and comments for smaller stylesheets, cleaner delivery, and deployment workflows→CSV FormatterTableNormalize CSV rows, delimiters, quoting, whitespace, and column structure into consistent downloadable output.→CSV MergerTableCombine compatible CSV datasets into one file while checking headers, delimiters, and record structure.→CSV SplitterTableSplit a large CSV dataset into smaller files by row count while preserving the header and record structure.→CSV ValidatorValidatorValidate CSV structure, detect inconsistent rows, and identify quoting or delimiter problems before import.→CSV ViewerTableOpen CSV data in a clear table, inspect rows and columns, and review structured records before using them elsewhere.→CSV to JSON: Best Free Online ConverterDeveloperCSV to JSON converts CSV rows into structured JSON for APIs, imports, scripts, testing, and migration. Review headers, values, quoting, and the final result before copying the output.→Case ConverterTextConvert text to camelCase, PascalCase, snake_case and more.→Certificate DecoderEncode DecodeDecode X.509 PEM certificates and inspect subject, issuer, validity, fingerprints, SAN entries, signature algorithm, and key usage.→Character CounterTextMeasure characters with and without spaces, plus words and lines, for social posts, forms, metadata, and editing→Checksum CalculatorEncode DecodeCalculate CRC32, MD5, SHA-1, SHA-256, SHA-384, or SHA-512 checksums from exact text and compare deterministic outputs across systems.→Collapse SpacesTextCollapse repeated horizontal spaces into one space while preserving line breaks, paragraph structure, and the order of your text.→Comma List to LinesTextConvert comma-separated values into one trimmed item per line, omit empty entries, and prepare a clean vertical list for spreadsheets or imports.→Cron Expression BuilderGeneratorBuild and validate five-field cron expressions with presets and human-readable explanations.→Duplicate Paragraph RemoverTextRemove repeated paragraphs while preserving order.→Email ExtractorTextFind email addresses in authorized pasted text, remove repeated matches, and return a clean copyable list in first-seen order.→Emoji RemoverTextRemove emoji symbols and related joiner characters from text while preserving surrounding words, punctuation, spacing, and line structure.→Find and ReplaceTextReplace every exact occurrence of a chosen text value while keeping the source available for comparison.→GraphQL FormatterDeveloperGraphQL Formatter turns compressed GraphQL queries, mutations, fragments, and variables into readable structured output for faster review, debugging, and team collaboration.→GraphQL MinifierDeveloperGraphQL Minifier removes unnecessary whitespace and comments from GraphQL queries while preserving operations, fragments, variables, directives, and string values.→HMAC GeneratorGeneratorGenerate keyed HMAC digests from a message and secret using SHA-256, SHA-384, or SHA-512, with clear hexadecimal output for testing integrations.→HTML BeautifierDeveloperFormat compact or inconsistent HTML with readable indentation, line breaks, nested elements, comments, and document structure.→HTML DecoderEncode DecodeDecode HTML entities into readable characters for content cleanup, debugging, migration, and template review→HTML EncoderEncode DecodeEncode reserved HTML characters into entities for safe display in examples, documentation, templates, and web content→HTML MinifierDeveloperMinify HTML by removing unnecessary whitespace and comments for smaller markup, faster transfer, and deployment preparation→HTML Tag RemoverDeveloperRemove HTML tags from markup while keeping readable text for cleanup, migration, extraction, and content preparation→HTTP Header BuilderGeneratorBuild validated HTTP request and response header blocks for APIs, security, caching, CORS, and content negotiation.→HTTP Status Code LookupNetworkLook up an HTTP response code and understand its official class, common meaning, and practical debugging context.→Hash GeneratorGeneratorUse this free Hash Generator to create MD5, SHA-1, SHA-256, and SHA-512 hashes from text, verify exact input, and copy results online.→Hashtag ExtractorTextExtract unique hashtags from captions, notes, and campaign text in their original first-seen order.→JSON CompareCompareCompare two JSON documents online, validate their syntax, normalize formatting, and highlight added, removed, changed, and unchanged lines.→JSON Diff ViewerCompareCompare two JSON documents online, validate their syntax, normalize formatting, and inspect added, removed, or changed values in a clear diff.→JSON EscapeEncode DecodeEscape quotes, backslashes, line breaks, tabs and Unicode-safe text for use inside JSON string values, API payloads and configuration files.→JSON FormatterDeveloperFormat and indent JSON so objects, arrays, keys, and values are easier to inspect, debug, validate, and share→JSON MergeConverterMerge 2 JSON documents online with recursive object merging, selectable conflict priority and replace, append or unique array strategies.→JSON MinifierDeveloperMinify formatted JSON into a compact single-line representation for APIs, storage, testing, and data transfer.→JSON Schema GeneratorGeneratorGenerate a JSON Schema from sample JSON online. Choose Draft 4, 6, 7, 2019-09 or 2020-12, infer nested types and detect common string formats.→JSON Schema ValidatorValidatorJSON Schema Validator checks JSON against a schema, reports exact validation paths, and helps you review required fields, types, formats, arrays, and nested objects online.→JSON SorterDeveloperUse this free JSON Sorter to alphabetize object keys recursively while preserving values, nested structures, and array order online.→JSON UnescapeEncode DecodeDecode JSON escape sequences such as escaped quotes, backslashes, newlines, tabs and Unicode sequences into readable text.→JSON ValidatorValidatorValidate JSON syntax and identify parsing errors before using data in an API, application, import, or configuration.→JSON ViewerDeveloperView JSON online as a readable tree, pretty-printed document, or flattened JSON path list with value types and depth controls.→JSON to CSVConverterConvert a JSON array of objects into CSV rows for spreadsheets, reports, imports, and structured-data review.→JSON to YAMLConverterConvert JSON data to readable YAML.→JWT DecoderEncode DecodeDecode JWT header and payload data for inspection without verifying the token signature or authenticity.→JWT GeneratorGeneratorCreate signed HS256 JSON Web Tokens.→JavaScript BeautifierDeveloperUse JavaScript Beautifier to format compact JavaScript online with readable indentation, braces, statements, operators, comments, strings, and template literals.→JavaScript MinifierDeveloperUse JavaScript Minifier to remove comments and unnecessary whitespace from JavaScript online while preserving strings, template literals, identifiers, and operators.→Line CounterTextCount total, non-empty, and blank lines in text, code, lists, logs, and documents with a clear browser workflow→Lines to Comma ListTextJoin non-empty trimmed lines into one comma-separated list while preserving the original item order.→Lowercase ConverterTextConvert cased letters to lowercase while preserving punctuation, spaces, and line breaks.→MD5 GeneratorGeneratorUse this free MD5 Generator to generate a MD5 hash from exact text, verify whitespace and encoding, and copy a clean hexadecimal digest online.→Markdown PreviewTextRender common Markdown syntax as safe HTML so structure and formatting can be reviewed before publishing.→Markdown to HTMLConverterConvert common Markdown syntax into HTML for previews, documentation, articles, notes, and lightweight publishing workflows.→Mention ExtractorTextExtract unique @mentions from authorized text and preserve the order in which accounts first appear.→Number ExtractorTextExtract signed integers and decimal values from mixed text while preserving their original order.→OpenAPI GeneratorGeneratorGenerate an OpenAPI 3.1 document from endpoint settings and JSON request or response samples.→OpenAPI ValidatorValidatorOpenAPI Validator reviews OpenAPI documents for structural and reference problems, helping teams detect invalid paths, operations, schemas, parameters, and responses online.→PEM FormatterEncode DecodeFormat PEM certificates and keys, validate matching boundary labels, and wrap Base64 content into standard 64-character lines.→Paragraph CounterTextCount non-empty text paragraphs separated by one or more blank lines.→Password Generator AdvancedGeneratorGenerate strong random passwords with custom length, character sets, exclusions, quantity controls, and secure browser-friendly output.→Password Strength CheckerValidatorCheck password strength using length, character variety, repetition, sequences, and common-pattern signals while keeping the result easy to understand.→Phone Number ExtractorTextExtract likely phone numbers from mixed text while preserving their original appearance and order.→Prefix LinesTextAdd the same prefix to every following line while preserving line order and line breaks.→Query String ParserNetworkParse a complete URL or raw query string into structured, readable JSON without changing the original input.→Quote LinesTextWrap every source line in quotation marks while preserving line order and line breaks.→RSA Key GeneratorGeneratorGenerate RSA public and private key pairs in PEM format with selectable key sizes and optional passphrase protection.→Random Password GeneratorGeneratorGenerate strong random passwords with a chosen length for accounts, test data, temporary credentials, and security-focused workflows.→Reading Time CalculatorCalculatorEstimate how long a text takes to read from its word count using a clear words-per-minute model.→Regex BuilderGeneratorBuild practical regular expressions from common matching requirements.→Regex ExtractorDeveloperExtract all regex matches and capture groups from text.→Regex ReplaceDeveloperReplace regex matches with text or capture-group references.→Regex Tester PRODeveloperTest regular expressions with detailed matches, named groups, offsets, line and column positions, execution timing, and highlighted previews.→Remove All SpacesTextRemove every whitespace character, including spaces, tabs, and line breaks, to create one uninterrupted string.→Remove Duplicate LinesTextKeep the first occurrence of each exact line, remove later duplicates, and preserve the original line order.→Remove Duplicate WordsTextRemove repeated words case-insensitively while keeping each first spelling and the original first-seen order.→Remove Empty LinesTextDelete blank and whitespace-only lines while preserving every populated line in its original order.→Remove Line NumbersTextStrip common leading line-number formats while leaving the remaining line content intact. Use it on copied transcripts, numbered exports, documentation and code samples.→Remove NumbersTextRemove numeric digits from text while keeping letters, punctuation, spacing, and line order available for review.→Remove PunctuationTextRemove punctuation characters from text while preserving words, numbers, spaces, and line order for review.→Remove TabsTextRemove tab characters from text while keeping the remaining content and line structure visible for comparison.→Remove WordTextremove word with a focused browser utility that targets the entered term while keeping the original source visible for careful comparison.→Reverse LinesTextreverse lines with a focused browser tool that changes only the order of complete lines while keeping every word, number, symbol, and punctuation mark inside each line unchanged.→Reverse TextTextreverse text with a browser utility that returns characters in the opposite order while keeping the original source visible for direct comparison.→Reverse WordsTextreverse words with a focused tool that changes the order of word tokens while keeping the characters inside each individual word readable.→SHA1 GeneratorGeneratorUse this free SHA1 Generator to generate a SHA-1 hash from exact text, verify whitespace and encoding, and copy a clean hexadecimal digest online.→SHA256 GeneratorGeneratorUse this free SHA256 Generator to generate a SHA-256 hash from exact text, verify whitespace and encoding, and copy a clean hexadecimal digest online.→SHA512 GeneratorGeneratorUse this free SHA512 Generator to generate a SHA-512 hash from exact text, verify whitespace and encoding, and copy a clean hexadecimal digest online.→SQL BeautifierDeveloperFormat SQL queries with readable clauses, indentation, line breaks, joins, conditions, grouping, and ordering.→SQL FormatterDeveloperFormat SQL statements with clearer indentation and line breaks for review, debugging, documentation, and database development.→SQL MinifierDeveloperCompress SQL queries by removing comments and unnecessary whitespace while keeping statements easy to copy and deploy.→SSH Key GeneratorGeneratorGenerate an RSA SSH public and private key pair with selectable strength, OpenSSH public-key output, and a SHA-256 fingerprint.→Secure Random GeneratorGeneratorGenerate cryptographically secure random bytes, strings, URL-safe values, and integers for development and security workflows.→Sentence Case ConverterTextThis sentence case converter changes irregular capitalization into a sentence-style pattern while keeping the original text available for comparison.→Sentence CounterTextUse this sentence counter to estimate the number of sentence units in articles, essays, notes, product descriptions, and other text.→Shuffle LinesTextShuffle lines into a random order while keeping every line available for review in a separate result.→Slug Generator: Best Free Online ToolTextSlug Generator creates a clean, lowercase, hyphenated URL slug from any title or phrase. Use this free online tool to review an SEO-friendly result before publishing or changing a permalink.→Sort LinesTextSort lines in ascending alphabetical or natural order while preserving the original source for comparison.→Sort Lines DescendingTextSort lines from Z to A or from higher to lower natural values with a separate result for verification.→Suffix LinesTextAdd the same suffix to every line while keeping the original list visible for careful comparison.→Tabs to SpacesTextReplace tab characters with a consistent number of spaces for code, plain text, logs, tables, and formatting cleanup→Text Diff CheckerCompareCompare two text versions line by line and identify additions, removals, and unchanged content.→Text RepeaterTextRepeat text a chosen number of times with predictable separators for testing, templates, sample data, and content preparation→Text StatisticsTextMeasure words, characters, sentences, paragraphs, lines, and estimated reading time in one document overview.→Timestamp ConverterConverterConvert Unix timestamps and date-time values.→Title Case ConverterTextConvert headings and titles into consistent title case for articles, pages, product names, documents, and publishing workflows→Token GeneratorGeneratorGenerate secure session, CSRF, URL-safe, hexadecimal, and Base64 tokens from cryptographically secure random bytes.→Trim WhitespaceTextRemove unwanted spaces around every line without changing the meaningful text inside each line.→URL DecoderEncode DecodeDecode percent-encoded URLs and query values into readable text for debugging, analysis, testing, and content review→URL EncoderEncode DecodeEncode text and reserved characters for query strings, links, redirects, API requests, and safe URL handling→URL ExtractorTextExtract web addresses from text, HTML, logs, exports, and documents for audits, migration, outreach, and review→URL ParserNetworkUse this free URL Parser to split any absolute link into scheme, host, port, path, query parameters, and fragment online.→UUID DecoderEncode DecodeDecode a UUID into version, variant, hexadecimal fields, node data, clock sequence, and timestamp information when the version supports it.→UUID GeneratorGeneratorGenerate random UUID version 4 identifiers for development, databases, fixtures, APIs, testing, and content-management workflows.→UUID ValidatorValidatorValidate UUID syntax online, identify versions 1 through 8, confirm the RFC variant, and understand why an identifier is invalid.→Unique Word FinderTextFind distinct words, repeated terms, and vocabulary patterns in text for editing, research, SEO, and content analysis→Uppercase ConverterTextConvert letters to uppercase instantly while preserving punctuation, numbers, spacing, and line order.→Word CounterTextCount words, characters, sentences, and paragraphs in text for writing, editing, SEO, study, and content planning→Word Frequency CounterTextCount how often every word appears, rank repeated terms, and inspect vocabulary balance in any pasted text.→Words to LinesTextPlace words or separated values on individual lines for lists, imports, cleanup, deduplication, and data preparation→XML CompareCompareCompare two XML documents online, validate their structure, normalize indentation, and review changed elements, attributes, text nodes, and line positions.→XML Formatter: 7 Amazing Proven TipsDeveloperFormat and indent XML for easier inspection, debugging, configuration review, data exchange, and development workflows→XML Validator: 7 Amazing Proven TipsValidatorValidate XML structure and syntax to find malformed tags, broken nesting, and parsing problems before import or deployment→XML to CSVConverterConvert repeated XML records into CSV rows for spreadsheets, imports, reporting, and data review.→XML to JSONConverterConvert XML elements, attributes, text values, and repeated nodes into readable structured JSON online.→YAML CompareCompareYAML Compare helps you compare two YAML documents, detect added, removed, changed, and type-mismatched values, and review differences with a clear online workflow.→YAML FormatterDeveloperFormat and indent YAML data.→YAML ValidatorValidatorValidate YAML syntax and structure.→YAML to JSONConverterConvert YAML data to formatted JSON.→cURL BuilderGeneratorBuild secure cURL commands for HTTP requests with methods, headers, query parameters, authentication, and request bodies.→
Generator
Ready
CSP Policy Builder
Build a Content Security Policy header with source directives, reporting, nonce and security options.
Enforce and Report-Only modes Strict, WordPress, API and static presets Nonce and SHA hash sources Security warnings
Test new policies with Report-Only first. Avoid unsafe-inline and unsafe-eval whenever possible.
INPUT Policy mode
Generated CSP policy
HTTP header, policy value, warnings, and optional HTML meta tag.
About the tool
What CSP Policy Builder does
CSP Policy Builder is a powerful online Content Security Policy generator for creating safer HTTP response headers without manually assembling every directive. Choose a practical preset, edit source lists, add a reporting endpoint, and generate a copy-ready Content-Security-Policy or Content-Security-Policy-Report-Only header.
The CSP Policy Builder supports common directives including default-src, script-src, style-src, img-src, font-src, connect-src, frame-src, object-src, base-uri, form-action, and frame-ancestors. It also recognizes nonce and SHA-256, SHA-384, or SHA-512 hash sources.
How to use
- Choose the policy mode. Start with Report-Only on an existing website.
- Select a preset. Use Strict, WordPress, API, Static, or Custom as the starting point.
- Review source directives. Keep each source list as narrow as possible.
- Add nonces or hashes. Prefer these over unsafe-inline for scripts and styles.
- Configure reporting. Add an HTTPS endpoint when violation reporting is available.
- Generate and test. Review browser console reports before switching to enforcement.
Built for the task
Why use CSP Policy Builder?
Focused controls, predictable output, and a workflow designed around this exact transformation.
02
Nonce and hash support
Use nonce and SHA source expressions instead of broad inline-script permissions.
03
Visible warnings
Identify unsafe-inline, unsafe-eval, wildcard sources, and enforcement risks.
04
Copy-ready output
Generate an HTTP header, policy value, and supported meta-tag version.
Useful answers
Questions about CSP Policy Builder
Practical details about input, output, privacy, limits, and the best way to use this tool.
Answer 01
What is a CSP Policy Builder?
A CSP Policy Builder creates a Content Security Policy from selected directives and trusted source values, reducing syntax mistakes when preparing an HTTP security header.
Answer 02
Should I use Report-Only first?
Yes. Existing sites should normally deploy Content-Security-Policy-Report-Only first, review violations, fix required sources, and enforce only after testing.
Answer 03
What does default-src do?
default-src provides a fallback source list for fetch directives that are not explicitly defined. Specific directives such as script-src override it.
Answer 04
Are unsafe-inline and unsafe-eval safe?
No. They weaken important CSP protections. Prefer nonces, cryptographic hashes, external files, and narrowly scoped trusted sources.
Answer 05
Can CSP be added with a meta tag?
Some enforcement directives work in a meta tag, but Report-Only does not. Several directives and reporting features require an HTTP response header.
Answer 06
How do CSP nonces work?
A server generates an unpredictable nonce for each response, includes it in script-src or style-src, and places the matching nonce attribute on approved inline elements.
Answer 07
What is frame-ancestors used for?
frame-ancestors controls which parent pages may embed the document, helping protect against clickjacking. It must be delivered as an HTTP header.
Answer 08
Does this tool guarantee a secure policy?
No automated builder can understand every application dependency. Test representative pages, review violation reports, and have security-sensitive policies reviewed.
What is a CSP Policy Builder?
A CSP Policy Builder creates a Content Security Policy from selected directives and trusted source values, reducing syntax mistakes when preparing an HTTP security header.
Should I use Report-Only first?
Yes. Existing sites should normally deploy Content-Security-Policy-Report-Only first, review violations, fix required sources, and enforce only after testing.
What does default-src do?
default-src provides a fallback source list for fetch directives that are not explicitly defined. Specific directives such as script-src override it.
Are unsafe-inline and unsafe-eval safe?
No. They weaken important CSP protections. Prefer nonces, cryptographic hashes, external files, and narrowly scoped trusted sources.
Can CSP be added with a meta tag?
Some enforcement directives work in a meta tag, but Report-Only does not. Several directives and reporting features require an HTTP response header.
How do CSP nonces work?
A server generates an unpredictable nonce for each response, includes it in script-src or style-src, and places the matching nonce attribute on approved inline elements.
What is frame-ancestors used for?
frame-ancestors controls which parent pages may embed the document, helping protect against clickjacking. It must be delivered as an HTTP header.
Does this tool guarantee a secure policy?
No automated builder can understand every application dependency. Test representative pages, review violation reports, and have security-sensitive policies reviewed.
How CSP Policy Builder works
The CSP Policy Builder combines directive names with validated source expressions and produces a standards-oriented policy string. The generated output includes the complete HTTP header and a separate policy value for server configuration.
Content Security Policy reduces the browser locations from which scripts, styles, images, fonts, frames, and network connections may load. A narrow policy can limit the impact of injected markup, but CSP complements rather than replaces output escaping, sanitization, authentication, and secure coding.
12 important CSP Policy Builder controls
default-src supplies a fallback. script-src and style-src control executable scripts and styles. img-src and font-src cover visual assets. connect-src limits fetch, XHR, EventSource, and WebSocket connections. frame-src controls framed documents, while frame-ancestors controls who may frame your page.
object-src 'none', a narrow base-uri, and a restricted form-action are strong defaults for many applications. Review every source added by plugins, analytics, fonts, payment providers, embedded media, and API endpoints.
CSP nonces and cryptographic hashes
A nonce source has the form 'nonce-randomValue'. The value must be unpredictable and regenerated for each HTTP response. A matching nonce attribute authorizes the intended inline script or style.
Hash sources such as 'sha256-...' authorize exact inline content. Any content change requires a new hash. Nonces and hashes are normally safer than enabling 'unsafe-inline'.
Test with Report-Only before enforcement
Report-Only mode records violations without blocking resources. Exercise the site across login, checkout, account, admin, forms, embedded media, analytics, and third-party integrations. Investigate each violation rather than adding broad wildcards.
After reports stabilize, deploy the enforcement header gradually and continue monitoring. A policy that blocks critical scripts can break navigation, payment, authentication, or accessibility features.
Common CSP Policy Builder mistakes
Frequent mistakes include combining 'none' with other sources, allowing all domains with *, copying a static nonce into every response, using 'unsafe-eval' without necessity, and assuming a meta tag supports every directive.
Another mistake is defining only default-src and overlooking application-specific connections, frames, fonts, or form destinations. Use browser developer tools and CSP reports to discover legitimate dependencies.
Related Trexmi security and API tools
Continue with HTTP Header Builder, cURL Builder, or OpenAPI Generator.
Authoritative CSP references
Review the MDN Content Security Policy guide and the W3C CSP Level 3 specification.