Is my data private when using CSP (Content Security Policy) Builder?

Yes. Code Station operates completely client-side without external telemetry, uploads, or server proxies. Your data never leaves your device.

Can AI agents use CSP (Content Security Policy) Builder?

Yes. CSP (Content Security Policy) Builder supports browser-native WebMCP (Web Model Context Protocol) and local stdio MCP servers via codestation-mcp for automated workflows.

WebPKI & Advanced Cryptography

CSP (Content Security Policy) Builder

Keep this tool in your workbenchReport a problem

🔒100% In-Browser Cryptography. Operations execute locally using Web Crypto API. Private keys and passphrases never leave your browser.

Content Security Policy Builder

A+Score: 100/100

Directives Configuration

script-src (Controls JavaScript origins — critical for XSS prevention)

style-src (Controls stylesheets & inline styles)

default-src (Fallback for unspecified fetch directives)

object-src (Plugin / Flash control)

frame-ancestors (Clickjacking protection)

upgrade-insecure-requests (Forces HTTPS for all subresources)

Generated CSP Header

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests

HTML <meta> Tag

Nginx Configuration

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;

Loading WebPKI & Cryptography controls…

Browse the WebPKI & Advanced Cryptography station →

What does this tool do?

CSP (Content Security Policy) Builder: default-src, script-src, style-src, img-src, connect-src, font-src, object-src, frame-ancestors, base-uri → http header string, security audit score & grade, actionable risk warnings, html meta tag equivalent, nginx configuration directive, next.js headers configuration. Process locally in your browser. Inputs: default-src, script-src, style-src, img-src, connect-src, font-src, object-src, frame-ancestors, base-uri. Outputs: HTTP Header String, Security Audit Score & Grade, Actionable Risk Warnings, HTML Meta Tag Equivalent, Nginx Configuration Directive, Next.js Headers Configuration.

How to use it?

Provide the listed input and choose Build Policy. Review the result, then copy or download where available. Clear removes inputs and results.

Browser-local processing. No uploads, content logging, persistence or remote resource loading. Generated markup is inert text; files are treated as untrusted data.

100% in-browser cryptographic processing using Web Crypto API. Private keys, passphrases, AES-GCM payloads, and certificate requests are calculated client-side and never sent to any server.