Content Security Policy (CSP) Formatter
Local ProcessingFormat and beautify complex Content-Security-Policy (CSP) headers into clean, multiline directives.
How It Works & Processing Standards
Format and beautify complex Content-Security-Policy (CSP) headers into clean, multiline directives.
Tool processing runs in your browser. If you create a calculator or conversion share link, its values are included in the URL. See the privacy policy for account, analytics and advertising data.
Current Limits
- Maximum input length: 100,000 characters
When reviewing or editing security headers, directives such as default-src, img-src and script-src become easy to scan. Each directive ends with a semicolon.
What You Can Do
- One directive per line
- Splits on ;.
- Whitespace tidied
- Single spaces between values.
How to Use Content Security Policy (CSP) Formatter
- 1Paste the CSPPaste the header value.
- 2Read the resultSee it split by directive.
Examples
Three directives
Input: default-src 'self'; img-src 'self' data: https://cdn.example.com; script-src 'self'
Result: default-src 'self';
img-src 'self' data: https://cdn.example.com;
script-src 'self';
Common Use Cases
- Reviewing a CSP in a security audit
- Editing a policy to allow a new domain
Frequently Asked Questions (FAQ)
Does it rate the policy’s safety?
No, it only formats. Check risky values such as unsafe-inline yourself.