Content-Security-Policy parse (lite)

Client

CSP directive list view.

Content-Security-Policy parse

Tokenizes CSP directives from a pasted policy string—does not evaluate whether a page is safe to load. Processing runs in your browser—Toolcore does not need your paste for the core operation on this page.

Parses pasted headers only—no outbound HTTP from this page.

How to use

Paste or type in the main field, then read the output below. Use Load example when available, or open the page with ?q= / ?qb= so tickets and agents share the same input.

Loading…

Nearby workflows on Toolcore

  • CSP header builder — Build a Content-Security-Policy header from directive fields—copy for nginx, Express, or CDN configs locally. Useful when the same trace needs a sibling header split.
  • HTTP headers — Common request and response header fields—names, direction, and short summaries—filterable client-side. Useful when the same trace needs a sibling header split.
  • HTTP fetch test — Send GET/POST and other methods from your browser—see status and body; CORS limits apply. Useful when the same trace needs a sibling header split.
  • Luhn checksum (mod 10) — Paste a digit string (spaces ignored)—pass or fail Luhn for PANs, IMEI-style IDs, and test vectors; browser-only. Useful when the same trace needs a sibling header split.

Common use cases

  • Content-Security-Policy parse (lite) for quick local checks without uploading data.
  • Copy results into tickets, docs, or classroom notes.

Common mistakes to avoid

  • Unexpected input shape

    See the intro and how-to notes for accepted formats.

FAQ

Is processing local?

Yes—this runs entirely in your browser.

Agent prefill?

Use q or qb for the main text field when supported.

More tools

Related utilities you can open in another tab—mostly client-side.