CSP Analyzer
Parse a Content-Security-Policy field value and show directive syntax, duplicate behavior, and common fallback relationships locally.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Directives
Observations
Governing directive after fallback
How it works
Paste a Content-Security-Policy field value, not a full response. The tool lists syntactic and context-sensitive observations such as duplicate directives (where the first occurrence applies) and the directive that governs each fetch directive after the CSP Level 3 fallback rules. Directive names, source-expression keywords, sandbox flags and fallback chains follow the CSP Level 3 Editor's Draft, upgrade-insecure-requests, Mixed Content and Trusted Types (snapshot verified 2026-09-16); checks are syntactic only: host-source paths must be an RFC 3986 path-absolute (no query or fragment), report-to must be one RFC 9110 token, and each report-uri value must be an RFC 3986 URI-reference, but nonce/hash values are not decoded, host expressions are not matched against URLs, report endpoints are not resolved or fetched, and keyword interactions such as 'strict-dynamic' or 'unsafe-inline' precedence are not simulated. Directives outside that snapshot are reported as unrecognized rather than rejected. A comma-separated policy list is detected, but only the first policy is inspected. It does not test a live site, collect reports, or make a blanket safe/unsafe determination. Processing is local to this browser.