Your files stay on your device

Trusted types policy builder

Generate a Trusted Types policy skeleton from choices (policy name, sanitizer: DOMPurify, built-in Sanitizer API, or escape-only; enforced types TrustedHTML, TrustedScript, TrustedScriptURL; name restriction; default policy; report URI) plus the enforcing CSP directives and a report-first rollout order, refusing permissive pass-through policies.

Assembling the policy…

This assembles text only: it does not load DOMPurify for you, deploy headers, or check a live site. The report-only header exists so nothing breaks while sinks migrate; enforcement comes after the reports reach zero. The sibling Trusted Types readiness checker reads an already-served header, and the CSP evaluator reads any pasted policy.
Options

More web & auth tools

- CSP evaluator & builder (/web/csp)
- Subresource integrity (/web/sri)
All web & auth tools (/web)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/web/trusted-types-policy-builder
Markdown version: https://nutter.tools/web/trusted-types-policy-builder.md
Plain-text version: https://nutter.tools/web/trusted-types-policy-builder.txt
Agent index: https://nutter.tools/llms.txt