Free online tools that run in your browser
Your files never leave your device · No login required · 100% free
Convert, compress, calculate, generate, edit and check files right in your browser — fast, private and easy to use.
Search results
Popular tools
View all toolsBrowse by category
Popular file conversions
View all convertersProgramming
Learn and practise programming in your browser. Pick a language: write code, run it in a real terminal and follow the lessons step by step.
Why Shiklo Tools?
Simple, private tools that just work — right in your browser.
- Private Everything runs in your browser. Files are never uploaded.
- Secure Encrypted HTTPS connection, and nothing you open is stored on our servers.
- No login required No account, no sign-up, no email. Just open a tool and use it.
- Fast No upload or download wait — results appear instantly.
- Free All tools are free to use, with no limits.
- Works everywhere Phone, tablet or computer, in any modern browser.
🆕 New tools
★ Popular tools
Recently used
Frequently asked questions
Are my files or text uploaded anywhere?
No. Every tool runs inside your browser on your own device. Nothing you enter or open is sent to a server.
Do I need to create an account or log in?
No login is required. There are no accounts — open any tool and start using it straight away.
Are the tools really free?
Yes. All tools are free, with no limits or watermarks. The site is supported by ads.
Does it work on my phone?
Yes. The tools work in any modern browser on phones, tablets and computers.
Can I use the tools offline?
Once a tool has loaded it does its work on your device, so it keeps working even if your connection drops.
Which file types are supported?
PDF, Word, Excel, PowerPoint, OpenDocument and RTF documents, JPG, PNG, WebP, HEIC, AVIF, GIF and BMP images, MP4, MOV, WebM and MKV videos, MP3, WAV, M4A, OGG and FLAC audio, ZIP, 7z, RAR, TAR and GZIP archives, CSV, JSON, XML and plain text. Each tool lists exactly what it opens.
All tools with descriptions →
CSP Generator
Build a Content-Security-Policy header or meta tag from a strict starting point, and check any policy for common weaknesses.
A Content-Security-Policy (CSP) tells the browser exactly where a page may load scripts, styles, images, fonts and other resources from, and which sites may embed it. A good policy is the strongest defence against cross-site scripting (XSS): even if an attacker manages to inject a script tag, the browser refuses to run it. Writing a policy by hand, though, means remembering dozens of directives and keyword spellings.
This generator starts from a strict, sensible policy — everything from your own site only, no plug-ins, no framing, no form posts elsewhere — and lets you add the sources you need for each directive with quick buttons or by typing hosts. It outputs the policy as an HTTP header, a report-only header for testing, or a meta tag, and checks your policy as you build it. You can also paste any existing policy to see its weaknesses. Everything runs in your browser.
How to use CSP Generator
- Start from the strict starting point.
- Add the hosts and keywords each directive needs, such as a CDN in script-src.
- Choose the output: HTTP header, report-only header or meta tag.
- Copy the policy, deploy it in report-only mode first, then enforce it.
Features
- All main directives: default-src, script-src, style-src, img-src, connect-src, frame-ancestors and more.
- Strict starting point and quick source buttons.
- HTTP header, report-only header or meta tag.
- Optional report URL and upgrade-insecure-requests.
- Live checks for unsafe-inline, unsafe-eval, wildcards and missing directives.
- Check any existing policy by pasting it.
- Runs in your browser; nothing is sent.
The key directives
Fetch directives control where each kind of resource may come from; default-src is the fallback for those you don't set. A few directives protect against other attacks.
| Directive | Controls |
|---|---|
| default-src | Fallback for all resource types |
| script-src | JavaScript — the most important one |
| style-src | Stylesheets and inline styles |
| img-src, font-src, media-src | Images, fonts, audio and video |
| connect-src | fetch, XMLHttpRequest and WebSocket targets |
| object-src | Old plug-in content; set to 'none' |
| base-uri | The base element, used to redirect relative URLs |
| frame-ancestors | Which sites may embed the page (clickjacking) |
What the checks look for
The checks flag the weaknesses that make a policy easy to bypass. Allowing 'unsafe-inline' scripts without nonces or hashes lets injected inline scripts run, which defeats most of the point of CSP. 'unsafe-eval' allows code built from strings. Wildcards such as * or https: in script-src allow scripts from any site, including ones an attacker controls. A missing object-src, base-uri or frame-ancestors leaves well-known bypasses open, and plain http: sources can be tampered with in transit.
Rolling out a policy safely
A strict policy will often break something at first — an analytics snippet, an embedded video, an inline script. Start with the report-only header, which only reports what would be blocked, watch the browser console or your report URL for a few days, add the sources that are really needed, and then switch to the enforced header. Prefer nonces or hashes over 'unsafe-inline' for inline scripts, and avoid broad host lists when a single CDN path will do.
Header or meta tag?
Sending the policy as an HTTP response header is best: it applies before any HTML is parsed and supports every directive. A meta tag is handy when you can't change server headers, such as on some static hosts, but frame-ancestors, report-uri and sandbox don't work in meta tags, so the tool leaves them out and tells you. Set headers in your web server, CDN, hosting dashboard or framework middleware.
Related tools
Check which security headers your site already sends with the Security Headers Checker, add Subresource Integrity hashes to CDN scripts with the SRI Hash Generator, and control browser features such as the camera and microphone with the Permissions-Policy Generator.
Frequently asked questions
How do I create a Content-Security-Policy?
Start from the strict starting point, add the sources your site needs, and copy the header.
What is a good starting CSP?
default-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none' — then add what your site needs.
Why is 'unsafe-inline' bad?
It lets injected inline scripts run. Use nonces or hashes instead.
Can I check an existing CSP?
Yes. Paste it into Check an existing policy.
Should I use a header or a meta tag?
A header when possible; meta tags don't support frame-ancestors or reporting.
How do I test a policy without breaking my site?
Use the report-only header first and watch what would be blocked.
Is anything sent to a server?
No. The tool runs in your browser.
Related tools
Security Headers CheckerCheck a website's HTTP security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy and more — get a grade and how to fix each gap.
Permissions-Policy GeneratorBuild the Permissions-Policy header that turns off the camera, microphone, location and other browser features your site doesn't use.
SRI Hash GeneratorCreate Subresource Integrity hashes (sha384 and more) for scripts and stylesheets, with the ready script or link tag to paste.
security.txt GeneratorCreate a valid security.txt file (RFC 9116) so researchers know how to report vulnerabilities — with checks for every field.
Meta Tag GeneratorGenerate the title, meta description, canonical, robots, Open Graph and Twitter / X tags for a page, with Google and social previews.
Robots.txt Generator & TesterCreate a robots.txt with rules per crawler, AI crawler blocking and sitemap lines, then test any URL against any robots.txt file.