---
title: "CSP Parser - Review directives in CSP headers | Web ToolBox"
description: "Parse Content Security Policy headers and review each directive. It helps you check for entries such as unsafe-inline and wildcards when reviewing CSP settings."
canonical_url: "https://web-toolbox.dev/en/tools/csp-parser"
meta:
  author: K
  "og:description": "Parse Content Security Policy headers and review each directive. It helps you check for entries such as unsafe-inline and wildcards when reviewing CSP settings."
  "og:image": "https://web-toolbox.dev/og/en/tools/csp-parser-604d0b11.png"
  "og:image:alt": "CSP Parser"
  "og:image:height": "630"
  "og:image:width": "1200"
  "og:title": "CSP Parser - Review directives in CSP headers | Web ToolBox"
---

> Index of every page on this site: [llms.txt](https://web-toolbox.dev/llms.txt)

# **CSP Parser**

Parse CSP headers and list their directives

**Content Security Policy**

## What is CSP Parser?

CSP Parser is a tool for reading a Content Security Policy header and breaking it down into easier-to-review directives. It also runs a quick local audit so you can spot risky patterns more easily.

When you paste a CSP string into the tool, directives such as `**script-src**` and `**img-src**` are grouped by category, and values like `**'unsafe-inline'**` or wildcards become easier to notice.

## How to Use

1. Paste a CSP header into the input area.
2. Review the quick audit results.
3. Check the directive list grouped by category.
4. Use the color-coded badges to spot keywords, domains, and riskier values.

Because the parser reacts immediately, it is useful when you want to compare small CSP changes as you edit them.

## Main Things to Review

### Quick Audit

The tool performs a lightweight check for common issues such as:

- `**'unsafe-inline'**` or `**'unsafe-eval'**`
- Wildcards like `*****`
- Missing `**default-src**`
- Use of `**http:**`

The result is shown with HIGH / MEDIUM / LOW severity, but it is still only a basic pattern-based check rather than a full security review.

### Policy Breakdown

Directives are grouped into categories such as Fetch, Document, Navigation, and Reporting. This makes it easier to understand how the policy is structured overall.

### Color-coded Badges

Source values are color-coded so you can quickly distinguish:

- Riskier values
- Values that need caution
- CSP keywords
- Domain-based sources

This is especially helpful when reviewing a long policy at a glance.

## Use Cases

- Doing a first pass on a newly written CSP
- Investigating a `**Content Security Policy violation**`
- Reviewing an existing site's policy for risky settings
- Checking how a new CDN, analytics script, or API source affects the policy

## Input and Output Example

```text
default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:
```

With a policy like this, you can inspect directive entries such as:

```text
default-src: 'self'
script-src: 'self' https://cdn.example.com
style-src: 'self' 'unsafe-inline'
img-src: 'self' data: https:
```

Settings such as `**'unsafe-inline'**` can also be surfaced as items worth reviewing.

## Things to Keep in Mind

- The audit is a quick check, not a guarantee that a policy is secure
- A valid CSP does not by itself eliminate all application security issues
- Before using a policy in production, it is safer to test it with Report-Only mode and verify actual site behavior as well

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://web-toolbox.dev/en#website","@type":"WebSite","description":"アカウント登録不要で使える無料Web開発ツール80種類以上。JSON整形、Base64変換、カラーコード変換、QRコード生成などをブラウザ上で瞬時に実行。開発者の作業効率を大幅に向上させます。","inLanguage":"en-US","name":"Web ToolBox","url":"https://web-toolbox.dev/en","translationOfWork":{"@id":"https://web-toolbox.dev/#website"}},{"@id":"https://web-toolbox.dev/en/tools/csp-parser#webpage","@type":"WebPage","description":"Parse Content Security Policy headers and review each directive. It helps you check for entries such as unsafe-inline and wildcards when reviewing CSP settings.","name":"CSP Parser - Review directives in CSP headers","url":"https://web-toolbox.dev/en/tools/csp-parser","isPartOf":{"@id":"https://web-toolbox.dev/en#website"},"potentialAction":[{"@type":"ReadAction","target":["https://web-toolbox.dev/en/tools/csp-parser"]}]},{"@id":"https://web-toolbox.dev/en/tools/csp-parser#/schema/web-application/1","@type":"WebApplication","applicationCategory":"UtilityApplication","description":"Parse Content Security Policy headers and review each directive. It helps you check for entries such as unsafe-inline and wildcards when reviewing CSP settings.","name":"CSP Parser - Review directives in CSP headers","operatingSystem":"Windows, macOS, Linux, Android, iOS"}]}
```

## Sitemap

See the full [sitemap](https://web-toolbox.dev/sitemap.md) for all pages.