How to use this developer tool
- Paste or upload the expected source text.
- Review any options shown below the input.
- Select Merge Policies or press Ctrl/Cmd + Enter.
- Check the notes, then copy or download the output.
Content Security Policy Merger
Merge two CSP drafts into one normalized policy for editing and comparison. Enter the policies above and below the separator line. Directives from both sides are combined and duplicate source expressions are removed while their first-seen order is retained. The result is a union, which can be less restrictive than either original policy. Treat it as a drafting aid and review every added origin before deployment.
Developer Input
two CSP draftsAd space
What this developer tool does
Content Security Policy Merger turns the entered source into a structured or generated result that can be inspected before use.
Parses both policies by directive, unions their source lists, keeps flag directives, and serializes directives with semicolons.
Input stays in this browser tab. Always remove live secrets before sharing screenshots or downloaded results.
Example
Input
default-src 'self'; script-src 'self' https://cdn.example.com --- default-src 'self'; img-src 'self' data:; script-src https://analytics.example.com
Running the sample produces output that reflects the parsed fields and reports any unsupported or security-sensitive detail.
Use cases
- Translate copied API documentation into project code.
- Inspect request, response, or header configuration during debugging.
- Create a reviewable draft for tests and documentation.
- Spot malformed, duplicate, or overly broad values before deployment.
Tips for reliable output
- Remove real tokens, cookies, and API keys before pasting.
- Keep quoted values intact when copying shell commands.
- Read warnings instead of assuming every option was converted.
- Test generated code against a staging endpoint first.
- Review browser and server security rules separately.
Processing details
Parses both policies by directive, unions their source lists, keeps flag directives, and serializes directives with semicolons. Processing is deterministic except where cryptographic random values are intentionally generated.
This browser tool does not execute remote requests, expand shell variables, inspect server behavior, or replace application-specific security review.
Frequently asked questions
Does Content Security Policy Merger send my input to a server?
No. Processing runs in the browser and the page does not transmit the entered text.
What input does Content Security Policy Merger support?
Paste two CSP policies separated by --- using the syntax shown in the sample.
Can I use the generated output in production?
Use it as a reviewed starting point. Environment-specific security, authentication, and error handling still need verification.
Why might Content Security Policy Merger report a limitation?
The parser handles documented common syntax and reports constructs that would require shell, browser, or server context.
How can I verify the Content Security Policy Merger result?
Compare the parsed URL, headers, body, directives, or origins with the source and test the final configuration in a non-production environment.
Related developer tools
Output fields
| Field | Meaning |
|---|---|
| Output | Generated or parsed text |
| Summary | Counts and completion state |
| Notes | Warnings and review guidance |
HTTP & Security Headers
Browse more tools in this developer category.
Open category hub