Dekrypt Security

Tool

CSP analyzer

Runs entirely in your browser. Nothing you enter is sent anywhere or stored.

How to use it

Paste the value of a Content-Security-Policy header. The analyzer parses each directive and flags common weaknesses.

How this works

  • I parse the policy you paste and flag 'unsafe-inline', 'unsafe-eval', wildcards, and missing base-uri, object-src and frame-ancestors. Each finding comes with an explanation.
  • Only the text you paste is read. Your site is not fetched, so headers set elsewhere are not seen.