No Login Data Private Local Save

Permissions‑Policy Header Parser - Online Decode & Check

8
0
0
0

Permissions-Policy Header Parser

Paste a Permissions-Policy (formerly Feature-Policy) HTTP header to decode and inspect permissions for your site.

Header Value
Separate directives with commas. Origins are space-separated inside parentheses, e.g., (self "https://example.com").
Parsed Directives

Enter a header value and click Parse to see decoded directives.

Common Permissions-Policy Directives

Directive Description Example Default
camera Controls access to video input devices camera=(self) All origins allowed
microphone Controls access to audio input devices microphone=() All origins allowed
geolocation Controls access to Geolocation API geolocation=(self "https://maps.example.com") All origins allowed
fullscreen Controls ability to use Fullscreen API fullscreen=* All origins allowed
interest-cohort Controls FLoC tracking (Privacy Sandbox) interest-cohort=() Allowed (opt out recommended)
accelerometer, gyroscope, magnetometer Controls sensor APIs accelerometer=() All origins allowed

Frequently Asked Questions

The Permissions-Policy header (formerly Feature-Policy) allows a website to control which browser features and APIs can be used by the current page and embedded iframes. It helps improve security and privacy by restricting sensitive capabilities like camera, microphone, geolocation, etc.

Feature-Policy was the original header, but it has been replaced by Permissions-Policy. The new header uses a simpler syntax (directive=() instead of directive 'none') and is now the standard. Browsers will gradually drop support for Feature-Policy.

An empty allowlist () means the feature is completely blocked for the current origin and all embedded contexts. For example, camera=() disables camera access entirely.

Yes, * means the feature is allowed for all origins (both same-origin and cross-origin iframes). However, use it cautiously because it may weaken your site's security posture.

Simply copy the raw value of the Permissions-Policy HTTP response header (from browser DevTools → Network tab) and paste it into the input field above. Click Parse Header to see a clear breakdown of what each directive allows or blocks.
🔧 Related Tools