Permissions-Policy Generator
Build HTTP Permissions-Policy directives for browser features.
Syntax Checker & Code Validator
About Permissions-Policy Generator
The HTTP `Permissions-Policy` (Feature-Policy) Header Builder configures browser hardware and API permissions (Camera, Microphone, Geolocation, Fullscreen, Payment, USB, Display Capture) for first-party origins and embedded `<iframe>` elements.
How to Use Permissions-Policy Generator
Step 1
Toggle permissions for each hardware feature (Self, Disabled, or Custom Origin).
Step 2
Review the assembled `Permissions-Policy` header in real time.
Step 3
Copy the HTTP header snippet or HTML iframe attribute.
Practical Use Cases for Permissions-Policy Generator
Restricting Third-Party `<iframe>` Hardware Access
Block embedded third-party ad widgets and social embeds from accessing device microphones, cameras, and payment APIs.
Hardening Web Application Attack Surface
Explicitly disable unused browser features (e.g. `usb=()`, `accelerometer=()`, `interest-cohort=()`) to protect user privacy.
Input & Output Examples
Restricting Camera & Geolocation to Self Only
Camera: Self, Geolocation: Self, Microphone: Disabled, USB: Disabled
`Permissions-Policy: camera=(self), geolocation=(self), microphone=(), usb=()`
Key Features & Performance
- ✓Controls 30+ browser features: camera, microphone, geolocation, payment, fullscreen, display-capture, usb, clipboard-read, autoplay.
- ✓Origin scopes: `*` (All), `self` (Same-Origin), `()` (Disabled), or explicit domain whitelist (`https://trusted.com`).
- ✓Generates HTTP Header syntax and HTML `<iframe allow="...">` attribute markup.
- ✓100% Client-Side memory execution.
- ✓1-Click Copy Permissions-Policy header.
Key Terminology & Definitions
`Permissions-Policy` (formerly Feature-Policy)
A web standard header allowing web developers to selectively enable, disable, and modify the behavior of browser features and APIs.
Origin Allowlist
Specifying which origins are permitted to access a given feature (e.g. `camera=(self "https://app.example.com")`).