Calculator
What the Content Security Policy Generator does
Content Security Policy Generator: generates Status and Content-Security-Policy from Policy style. Example: policy style Strict (self only) gives status CSP ready.
This generator reads Policy style and produces Status and Content-Security-Policy. Adjust anything and the figures re-derive on the spot.
Most people who open the Content Security Policy Generator are anyone cleaning up machine output. Reading raw machine output is painful; a formatted view makes the structure obvious.
This runs client-side, which means we never receive what you enter and could not retrieve it if asked.
Each field is explained further down, along with the method and a worked example that uses the default values.
What do the Content Security Policy Generator fields mean?
The Content Security Policy Generator uses 1 input. The page opens in a usable state: real values in, real answer out, ready to edit.
| Field | What to enter | Default |
|---|---|---|
| Policy style | choose from Strict (self only), Allow common CDNs or Report-only starter | Strict (self only) |
How does the Content Security Policy Generator work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same generated output.
If something is off you are told which field, not given a generic failure.
Worked example
These are the values the Content Security Policy Generator loads by default, and the result it produces from them. Below is the same computation the tool performs on load, step by step.
| Policy style | Strict (self only) |
|---|
| Status | CSP ready |
|---|---|
| Content-Security-Policy | default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'… |
How to use it
- Pick a value for Policy style: the options are Strict (self only), Allow common CDNs or Report-only starter.
- Skip the submit button; there is not one. Editing is enough.
- Check Status and Content-Security-Policy on the right.
- Copy Link when you want to return to this exact configuration; Print when someone needs it on paper.
What this tool does not do
- Processing happens in your browser, so very large inputs are bounded by available memory.
- Output follows the common convention for this format; a specific toolchain may have its own house style.
- No allowance is made for local rules, regional variations or house conventions.
Frequently asked questions
Policy style, nothing else. Every box already holds a working value, so the quickest approach is to replace the one number you actually care about.
With the values loaded when the page opens, status comes out as CSP ready. Adjust any field to see how much the answer depends on it.
No: there is no server involved. Close the tab and the values are gone.
No charge. Everything on the page is available without signing in.
The formula is shown above precisely so you do not have to take the accuracy on trust.