UD5 Toolkit
Permissions‑Policy Header Generator - Online Security Config
Configure browser feature permissions (camera, microphone, geolocation) and generate the Permissions‑Policy HTTP header.
CSP Analyzer – Test & Improve Policy
Paste a Content-Security-Policy header value or enter a URL to fetch it automatically. Identify weaknesses, get improvement suggestions, and generate a hardened policy.
You can also drag & drop a
.txt file or paste from clipboard.Attempts to retrieve CSP via
fetch. If blocked, paste the policy manually.Frequently Asked Questions
Content Security Policy is an added layer of security that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. It allows web developers to define approved sources of content for their site.
CSP misconfigurations can leave your site vulnerable while over-restriction can break functionality. Our analyzer inspects each directive, flags risky values (like
'unsafe-inline', *), and suggests hardened alternatives to balance security and compatibility.We evaluate all standard fetch directives:
default-src, script-src, style-src, img-src, connect-src, font-src, object-src, media-src, frame-src, worker-src, and others. Also checks for base-uri, form-action, etc.High – Allows inline scripts/styles, eval, or wildcards that enable XSS. Medium – Uses loose schemes like
http: or data:. Low – Mostly secure with minor improvements possible.The optimizer removes
'unsafe-inline', 'unsafe-eval', replaces wildcard * with 'self', and upgrades http: to https:. It also suggests adding 'strict-dynamic' when nonces/hashes are present. Always test the generated policy before deploying.Yes, enter a full URL and click Fetch. The tool tries to read the
Content-Security-Policy response header. Due to browser CORS restrictions, this may not always succeed. In such cases paste the header value manually (you can copy it from DevTools → Network → Response Headers).HTTP Security Header Checker - Online HSTS, CSP, X-Frame Analysis
Paste response headers string and get a security audit. Check presence and configuration of key security headers. Local analysis.
Password Entropy Calculator - Online Bits of Security Meter
Calculate the entropy (in bits) of a password based on character pool size and length. Visual strength meter with crack time estimation. Local only.
Character Frequency Analyzer - Online Visual Heatmap of Text
Analyze letter/symbol frequency with an interactive bar chart and heatmap. Useful for breaking simple ciphers, linguistics, and SEO keyword analysis. Local processing.
SQL CREATE TABLE to CSV Header - Online Column Lister
Paste a SQL CREATE TABLE statement and extract just the column names as a CSV header row. For data migration.
Regex Injection / ReDoS Tester - Online Safe Pattern Test
Test a regular expression against malicious inputs to detect catastrophic backtracking and ReDoS vulnerabilities. Educational.
WAV Header Viewer - Online Inspect Audio Format
Drop a WAV file and see its full header: sample rate, bit depth, channels, and chunk structure. Raw bytes explained.
PDF Script Inspector - Online See Embedded JavaScript
Drop a PDF and extract any embedded JavaScript or form actions. Check for malicious code. Privacy‑friendly analysis.
SQL Injection Simulator - Online Educational Sandbox
Test SQL injection inputs on a mock database and see the resulting query. Learn how to prevent SQLi. No real data.
XSS Payload Sandbox - Online Test Escape Characters
Paste a potential XSS vector and see if it executes in a sandboxed iframe. For security researchers and education.
Security Headers Auditor - Online Check HSTS, CSP & More
Enter a website and check which security headers (HSTS, CSP, X‑Frame‑Options) are present. Get a security grade.
Reporting API Demo - Online See CSP & Deprecation Reports
Send a test CSP violation report and see the ReportingObserver in action. Understand how monitoring works.
Trusted Types API Demo - Online Prevent XSS
See how Trusted Types prevents unsafe HTML assignment. Test against injected scripts. Modern security practice.
ETag & Last‑Modified Validator - Online Check Cache Headers
Send conditional requests to a URL and verify that the server correctly handles ETag and If‑None‑Match. Audit caching.
position: sticky Playground - Online Sticky Headers & Footers
Scroll a container and see how sticky elements behave. Adjust top, bottom, and scroll margins. Copy the code.
3rd‑Party Script Impact Analyzer - Online See Cost
Enter a URL and see a waterfall of external scripts with their download size and execution time estimate. Identify performance culprits.
DNSSEC Chain Validator - Online Check RRSIG & DS
Validate a DNSSEC chain by entering DS and RRSIG records. Verify that signatures match. Educational. Local algorithm.
Permissions‑Policy Header Parser - Online Decode & Check
Paste the Permissions‑Policy header and get a human‑readable table of allowed/blocked browser features. Understand how your site is restricted.
Content Security Policy Evaluator - Online Hash & Nonce Check
Test if a script or style will be allowed by a given CSP. Compute hash/nonce. Strengthen your site’s defense against XSS. Local.
WebAuthn Demo - Online Register & Authenticate
Create a passkey and authenticate using the Web Authentication API. Supports platform authenticators (TouchID, FaceID). No server.
X‑Frame‑Options Tester - Online Clickjacking Defense
Check if a URL can be embedded in an iframe. Test your site’s defense against clickjacking. Browser‑based.
HSTS Header Checker - Online Strict‑Transport‑Security
Fetch a site’s HSTS header and validate its syntax, max‑age, and subdomain flags. Ensure your site enforce HTTPS.
Live Sound Frequency Detector - Online Audio Analyzer
Use your microphone to detect the dominant frequency of ambient sounds. Visualize the spectrum. Local Web Audio.
Iframe Sandbox Configurator - Online Test Permissions
Build an iframe with different sandbox flags and see live which features are blocked. For secure embedding.
String to Escaped HTML - Online Protect Against XSS
Instantly convert plain text into HTML‑safe escaped characters for secure display in web pages. Prevent cross‑site scripting. All processing local.
Tone Analyzer - Online Detect Emotion in Text
Paste text and get a rough analysis of its emotional tone (happy, sad, angry, etc.) based on keyword matching. Local.
HTML Sanitizer - Online Clean Dangerous Tags & XSS Prevention
Strip dangerous HTML tags and attributes (scripts, onclick) to prevent XSS attacks. Safe iframe preview. Local sanitation engine.
Phishing Email Checker - Online Suspicious Link Analyzer
Paste email headers or body text to quickly spot phishing signs, suspicious domains, and obfuscated links. Educational and private.
Password Strength Checker - Online Meter & Analyzer Tool
Evaluate the strength of your passwords with a visual meter and detailed feedback. Check for length, complexity, and breached passwords. All analysis is client-side.
Strong Password Generator - Online Random Secure Passwords
Generate ultra-secure, random passwords with configurable length and character sets. Created entirely on your device; never transmitted or stored.