Content Security Policy Parser
Inspect CSP directives, repeated directives and common risky source expressions in a pasted policy.
Start with your input
Edit the example or replace it with your own text.
How to use Content Security Policy Parser
- Paste the example or your own input.
- Choose the options that match your task.
- Run the tool, review the result, then copy or download it.
When to use Content Security Policy Parser
Long Content-Security-Policy headers become easier to inspect when each directive is separated into a name and a source list. Paste one policy to see the first occurrence of every directive, any later duplicates and notes about common source expressions. This is useful when reviewing a deployment header or explaining why a repeated directive has not extended the earlier source list.
How to interpret the result
The report is a structural inspection, not a security grade or a browser enforcement simulator. It does not fetch resources, resolve default-src fallback chains, verify nonces, or combine multiple policy headers. Notes about unsafe-inline, unsafe-eval, wildcards and mixed none expressions call attention to values worth reviewing. Whether a resource loads still depends on the complete response, browser support, destination and execution context.
Example input
default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none'; base-uri 'self'
What should I check before using the output?
The report is a structural inspection, not a security grade or a browser enforcement simulator.
Is input uploaded?
Processing takes place in your browser. This tool does not send your input or selected files to a conversion API.