Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Web & auth
  3. Trusted types policy builder
Your files stay on your device

Trusted types policy builder

Generate a Trusted Types policy skeleton from choices (policy name, sanitizer: DOMPurify, built-in Sanitizer API, or escape-only; enforced types TrustedHTML, TrustedScript, TrustedScriptURL; name restriction; default policy; report URI) plus the enforcing CSP directives and a report-first rollout order, refusing permissive pass-through policies.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

Assembling the policy…

This assembles text only: it does not load DOMPurify for you, deploy headers, or check a live site. The report-only header exists so nothing breaks while sinks migrate; enforcement comes after the reports reach zero. The sibling Trusted Types readiness checker reads an already-served header, and the CSP evaluator reads any pasted policy.

Policy choices

Lowercase letters, digits, -, and #
HTML sanitizerWhat createHTML runs the raw string through
Enforced typesPick every sink shape your app assigns
Emits a trusted-types directive naming this policy
Adds default to the name list; a footgun, so it stays off by default
https: URL or a site path starting with /

The builder refuses pass-through policies on principle: createHTML always sanitizes or escapes, and the script sink throws until you deliberately replace it.

More web & auth tools

  • CSP evaluator & builder
  • Subresource integrity
All web & auth tools

Was this tool useful?