CSP violation report parser
Turn pasted CSP violation reports into a readable summary of which directives and sources are blocked.
CSP violation report parser
Paste the JSON your CSP report-uri endpoint or Reporting API collector received and this tool turns a wall of violation reports into a summary you can actually read: which directives are being blocked, and which sources are triggering them. It is built for developers rolling out or tightening a Content-Security-Policy, who need to see the pattern across dozens or hundreds of reports rather than reading them one at a time.
Group by directive to see which policy sections fire most, or group by blocked source to find the one script or stylesheet causing most of the noise. Hide reports from browser extensions — Chrome and Firefox send csp-report bodies with a chrome-extension: or moz-extension: blocked-uri whenever an installed extension trips the page's policy, which has nothing to do with your own code. Turn on affected pages to see every document URL a violation was seen on. Switch the output to suggested rules and the tool proposes the source-list additions — origins, 'unsafe-inline', data: — that would let each blocked directive through, as a starting point for widening the policy.
The parser accepts a JSON array, a single report object, or one report per line, and understands both the classic {"csp-report": {...}} POST body and the newer Reporting API {"type", "body"} envelope, so raw server logs paste in without reformatting. Reports that don't parse are skipped rather than failing the batch, and the tally shows how many reports came in, how many groups they collapsed into, and how many extension reports were filtered out.
Everything runs in your browser. The pasted reports are never uploaded anywhere, which matters since they can include internal URLs and page structure. Copy the summary, download it as a .txt file, or send it to the input of another tool to keep working.