OneFreePlace
FREE ONLINE TOOL

Free Content Security Policy
Builder

Generate a fresh unpredictable nonce for every HTTP response and apply the same value to the CSP and trusted script tags. Do not ship a static nonce.

Open this tool in its own window ↗

FreeUse this tool without paying.No sign upStart with the tool right away.Clear stepsRead the tool’s own guidance.

About Free Content Security Policy Builder

Build a nonce/hash-oriented CSP, audit unsafe allowances, add Trusted Types and reporting, test resource sources, calculate inline SHA-256 hashes, and export both HTTP and meta-tag forms with their limitations made explicit.

Workspace options

  • upgrade-insecure-requests
  • Require Trusted Types for script sinks
  • Trusted Types policy allowlist
  • report-to group name
  • Reporting-Endpoints URL
  • Deprecated report-uri fallback (optional)

Available actions

  • Builder
  • Audit
  • Nonce & hash
  • Deploy
  • Apply strict preset
  • Copy headers