Web security header tools
Locking down a web app means getting a handful of response headers right: a Content-Security-Policy that doesn't break the app it protects, Subresource Integrity hashes on third-party scripts, and cookies with the correct security flags. These tools let you draft and check that configuration before it goes into production, working from the exact header or script text you already have.
Use the CSP generator to test resource matching against a draft policy without making any real requests to your site, and the Security Headers Generator for the broader set covering CORS, HSTS and related headers together. The SRI hash generator produces the integrity attribute for a specific script or stylesheet file, and the cookie parser reads Cookie and Set-Cookie headers separately so flags like Secure and SameSite are easy to check. All of it runs in your browser.
5 tools
All Web Security Config tools
-
SRI hash generator
Generate SRI integrity hashes for script and stylesheet integrity attributes
-
Cookie parser
Inspect Cookie request and Set-Cookie response headers separately
-
Security Headers Generator
Draft CORS, CSP, HSTS and other security response headers
-
CSP generator
Design CSP headers and test resource matching without site requests
-
JWT debugger
Decode JWT claims as UTC dates and verify signatures with explicit keys
Web Security Config tools FAQ
A CSP is allow-list based, so anything not explicitly matched by a source expression is blocked by default, including inline scripts unless you permit them. The CSP generator lets you test how a draft policy matches specific resource URLs before you deploy it, without sending any real requests.
It stops a compromised or tampered third-party script or stylesheet from executing, by having the browser hash the fetched file and compare it to the integrity value before running it. The SRI hash generator computes that hash for a given script or stylesheet so you can add it to your tag.
Set-Cookie is sent by the server to create or update a cookie and can carry flags like Secure, HttpOnly and SameSite; Cookie is sent by the browser on later requests and carries only name-value pairs. The cookie parser inspects each one separately so flag issues are easy to spot.