How to Use This Tool
Serialize explicit directive rows without claiming the resulting policy is secure. Convert one CSP directive per line into a one-line response-header value, preserving source tokens and selecting enforce or report-only mode.
The exact task
Copying a multiline policy directly into server configuration can introduce missing separators, while a visual formatter must not imply that broad sources are safe. This page transforms only directive rows, mode: enforce or report-only. It does not fetch a remote resource, inspect an account, guess an omitted schema or claim that syntactically tidy output is operationally safe.
Transformation rule
Trim each nonblank row, validate a directive-name token plus at least one source token, preserve token order, and join directives with semicolon-space. The default fixture is executable, so a future change that alters punctuation, ordering, escaping or validation will fail before publication. Try a small representative sample first and compare every generated token with the source.
How to interpret the output
Review the serialized value token by token and deploy report-only first when changing a real site's policy; formatting success is not a security assessment. The supporting outputs—response header name, directive count—make the transformation auditable rather than presenting one opaque block to copy.
Assumptions
- Each nonblank line begins with one CSP directive name.
- Source expressions are already chosen by the user.
- Directive order is preserved exactly.
Keep the original text unchanged until the result has been tested in the destination system. Browser processing protects against an upload by this calculator, but it does not make sensitive material appropriate to paste into an untrusted device or extension.
Limitations and safety boundary
It does not validate every CSP grammar production, merge duplicate directives, analyze bypasses, fetch resources or recommend a secure allowlist. This is a preparation and review tool, not a standards-complete parser, security assessment, legal determination or production deployment system.
Source and verification
The transformation rule was checked against W3C Content Security Policy Level 3 on 2026-08-26. Recheck the destination specification when its grammar can change. All processing here runs in the current browser tab; ecech receives no input through a calculation API.
Sources & assumptions
Tool Spec v2 · verified 2026-08-26. Platform rules and fees can change; the editable inputs remain authoritative for your account.
Official references
- W3C Content Security Policy Level 3 (checked 2026-08-26)
Model assumptions
- Each nonblank line begins with one CSP directive name.
- Source expressions are already chosen by the user.
- Directive order is preserved exactly.
- It does not validate every CSP grammar production, merge duplicate directives, analyze bypasses, fetch resources or recommend a secure allowlist.
