CSP Builder
Build and risk-score Content-Security-Policy headers visually.
OpenEvaluate IAM-like, Cedar-lite, or Rego-lite policies against JSON input locally. - runs entirely in your browser. Free, fast and private.
IAM Statement JSON, Cedar-lite text, or Rego-lite rules.
Principal, action, and resource (or custom fields).
Deny-overrides-Allow for IAM-like statements.
See which statements or rules fired - locally only.
Policy Playground is a free password & security utility on OneDevToolkit. Evaluate IAM-like, Cedar-lite, or Rego-lite policies against JSON input locally. It runs in your browser for this session - use the workspace on this page to try it.
Need a related step? Open the Password & Security hub at /security-tools/ or the <a href="/blog/">blog</a> for longer workflows.
Processes data instantly with no server round-trips.
Your data never leaves your browser. Nothing is uploaded.
Works in any modern browser. Nothing to download or install.
No limits, no sign-up, no credit card required.
Works on desktop, tablet and mobile devices.
Beautiful in both themes. Your preference is saved.
Keyboard shortcut
Use Policy Playground when you need local crypto or credential helpers without sending secrets to a third-party site.
Generate or check values on-device before you store them in a password manager or deploy config.
Keep hashes, tokens, and passwords in the browser while you debug auth or APIs.
Answers for this tool. For site-wide help, open the FAQ hub.
Generators and hashers run locally. Still, never paste production secrets into any site if your security policy forbids it.
Results live in page memory until you leave or clear. Favourites/history do not save password fields unless you explicitly store them in Vault.
When applicable, tools rely on Web Crypto or well-known libraries. Read on-page notes for exact algorithms (SHA-256, bcrypt-style notes, etc.).
After load, crypto helpers typically work offline. Confirm network independence for your threat model.
Browser CSPRNG (crypto.getRandomValues) powers secure generators when the tool states so.
Treat generated secrets like passwords - share only through approved password managers, never chat apps.
OneDevToolkit aids technical workflows; it is not a certification product. See Compliance for processing model language.
Always check you are on your real OneDevToolkit domain before entering sensitive material.
Contact us via Contact with responsible-disclosure details - do not include live production secrets.