Security Headers Generator

Generate the security headers for nginx, Apache or Express.

Free
No signup
Nothing uploaded
No watermark

Format

Strict-Transport-Securitymax-age=31536000; includeSubDomainsTells browsers to use HTTPS for this domain for the next year, without asking first.Add preload only when you are certain — getting off the preload list takes months.X-Content-Type-OptionsnosniffStops the browser guessing a file’s type from its contents.Without it, an uploaded text file served with the wrong type can be executed as script.X-Frame-OptionsSAMEORIGINStops your pages being embedded in someone else’s iframe.Superseded by CSP frame-ancestors, but still read by older browsers.Referrer-Policystrict-origin-when-cross-originSends the full URL within your own site, only the origin to other sites, and nothing when downgrading to http.The default in modern browsers, but stating it protects readers on older ones.Permissions-Policygeolocation=(), microphone=(), camera=(), payment=(), usb=()Turns off browser features your site does not use, including inside any iframe you embed.An empty () means "no origin at all", which is what you want for a feature you never use.Cross-Origin-Opener-Policysame-originCuts the link between your page and any window that opened it.Required, with COEP, to use SharedArrayBuffer. Can break OAuth popups that use window.opener.Cross-Origin-Resource-Policysame-originStops other sites loading your resources directly.Set it to cross-origin on anything meant to be embedded elsewhere, such as a public CDN asset.

7 headers

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;

How to Use the Security Headers Generator Online

Generates security headers for nginx, Apache or Express. The high-value set is short: Strict-Transport-Security, X-Content-Type-Options, a Referrer-Policy and a CSP. X-XSS-Protection is obsolete and now recommended off, since its filter introduced vulnerabilities of its own.

No software to install Free Works on any device

Step-by-Step Guide to Using the Security Headers Generator

1

1. Set the options for your site
2

2. The header is built as you go, and anything that weakens it is flagged
3

3. Copy it into your server config

Try it now

What is the Security Headers Generator?

Why Use Security and Crypto Tools Locally?

Hashes, keys, tokens and passwords are exactly the things you should not paste into a stranger’s server. Here they are made and checked inside your browser, so secrets stay on the machine in front of you.

“A secret generated on your own device stays yours.”

Strong random passwords
Keys generated on your device
Two-factor codes for testing
Files checked against checksums

Hashes in every common algorithm
JWTs decoded and checked
Security headers written for you
No secrets sent anywhere

Popular Uses for Hash and Key Generators

Developers and careful users reach for these during everyday security work.

New passwords Generate a long random password or passphrase for a new account.
Verifying downloads Hash a file with SHA-256 and compare it with the value the publisher lists.
Debugging logins Decode a JWT to see its claims and check the signature with your secret.
SSH and API keys Create an RSA or Ed25519 key pair or an API key for a new service.
Website headers Write a Content Security Policy and other security headers for a web server.
Testing two-factor login Generate TOTP codes and secrets to test an authenticator setup during development.
Script integrity Make an SRI hash so a browser can tell if a CDN script was changed.
Password strength Measure how many guesses a password would take, using its entropy.

What You Can Do with the Security Headers Generator

Generation happens on your own machine, at your machine's speed

Builds a policy that states what it permits, rather than one that silently permits everything

Flags the directives most often set to a value that disables the protection they exist for

Why Use ToolXkit for Security Headers Generator?

Your files stay with you

Everything runs inside your browser. Nothing you open or type is uploaded to a server.

Crypto Tools for Different Users

Web developers

Create security headers, SRI hashes and JWTs while building and testing apps.

System administrators

Generate SSH keys, check fingerprints and verify file checksums on the go.

Security testers

Decode tokens, inspect PEM files and test HMAC signatures without extra tooling.

Computer science students

See how hashing, encryption and key pairs behave by trying them yourself.

Everyday users

Make strong passwords and passphrases that are never sent over the internet.

IT teams

Create API keys and OAuth values for new integrations in a safe place.

Best Times to Generate a Key or Hash

Local crypto tools make sense when you are:

Setting up a new server
Creating a strong password
Checking a downloaded installer
Debugging a sign-in problem
Adding security headers to a site
Testing an authenticator app
Learning how encryption works
Rotating an old API key

Frequently Asked Questions

Answers to common questions about this tool.

Do I need to install anything to use the Security Headers Generator?

No. Security Headers Generator runs entirely in your browser — there is nothing to download, no extension and no desktop program. It works the same on Windows, macOS, Linux, Android and iPhone.

Is it safe to use the Security Headers Generator online?

Safer than the usual alternative, yes. Most online tools upload your file to a server you know nothing about, where it sits until someone deletes it. Here the file never leaves your device — the processing happens in the page itself, so there is no server copy to leak, retain or sell.

Are the keys and passwords made here truly random?

They come from the browser’s built-in secure random number generator, the same source used for encrypted connections. That is suitable for passwords, keys and tokens.

Does Security Headers Generator send my secrets to a server?

No. Everything is worked out locally, and what you type or generate is neither uploaded nor logged. For real production keys, it is still wise to generate them on the machine where they will be used.

Is Security Headers Generator free for commercial projects?

Yes. Use it for personal, work or client projects at no cost and without an account. What you generate belongs to you, and the site keeps no copy.

Can a hash be reversed to get the original text?

No. A hash is one-way. Short or common passwords can still be guessed by trying many candidates, which is why a long, random password matters more than the hash you pick.

More Security & Crypto Tools

Other free tools for the same kind of job.

Browse all tools