HSTS Header Generator
Generate a correct Strict-Transport-Security header with safe max-age and preload guidance.
Runs 100% in your browser — nothing is ever uploaded.
What is HSTS Generator?
This free HSTS generator builds the Strict-Transport-Security header that forces browsers to always use HTTPS for your domain. Pick a max-age from safe presets (start small, then increase), toggle includeSubDomains and the preload flag, and copy the result as a raw header or as an Nginx/Apache directive. The tool warns you about preload requirements so you don't lock your domain in by accident.
How to use HSTS Generator
- Open the tool — no signup, no upload, everything runs in your browser.
- Fill in the HSTS options in the form; sensible defaults are pre-selected.
- The header output updates instantly with every change you make.
- Copy the result or download it as a ready-to-use file.
Frequently asked questions
Is this HSTS generator free to use?
Yes — this HSTS generator is completely free with no signup, no limits, and no watermarks. Use it as often as you like.
What is the HSTS preload list?
It's a list built into Chrome, Firefox, Safari and Edge of domains that are HTTPS-only from the very first request. To join it you need max-age of at least one year, includeSubDomains, the preload flag, and a submission at hstspreload.org — and removal can take months, so enable it carefully.
Is my configuration data private?
Absolutely. Everything is generated locally in your browser with JavaScript — no data, settings, or file contents are ever sent to any server.
Do these tools touch my servers?
No. OpsForge tools are pure calculators and generators that run in your browser — they never connect to your infrastructure. You copy the result and apply it yourself.
Is the chmod calculator accurate for all systems?
Yes — octal permission notation is a POSIX standard, so the results apply identically on Linux, macOS and BSD.
Will more DevOps tools be added?
Yes — Dockerfile, docker-compose, nginx and CI config generators are on the roadmap. Everything will stay free and client-side.