Permissions-Policy (Feature-Policy) HTTP Header Generator & Tester
Build, inspect, and validate modern Permissions-Policy HTTP response headers (camera, microphone, geolocation, payment) with strict per-origin allowlists.
Controls access to video input capture devices (webcams, front/back lenses).
Controls access to audio input recording devices and system microphones.
Controls access to fine and coarse GPS geographic coordinate coordinates.
Controls browser native Payment Request API dialogues and digital wallets.
Controls Screen Capture API allowing pages to record user desktops and displays.
Controls WebUSB API for low-level direct access to wired USB hardware devices.
Controls Web Bluetooth API to pair and read wireless Bluetooth LE peripherals.
Controls WebHID API for non-standard human interface devices and specialized gamepads.
Controls Web Serial API for bi-directional communication with RS-232 serial hardware.
Controls WebOTP API reading one-time SMS verification tokens from mobile OS.
Controls programmatic reading of sensitive text and graphics from system clipboard.
Controls programmatic writing of arbitrary data onto the user system clipboard.
Controls motion sensor measuring physical acceleration force along XYZ vectors.
Controls orientation sensor measuring angular rotational velocity in 3D space.
Controls magnetic field sensor acting as digital compass and orientation sensor.
Controls ambient light sensor measuring lux environmental illumination levels.
Controls Idle Detection API sensing user keyboard/mouse inactivity and screen lock.
Controls Web MIDI API interacting with synthesizers, controllers, and musical gear.
Controls selectAudioOutput() to route audio playback to discrete speaker sinks.
Controls Chrome Privacy Sandbox Topics API for cross-site interest ad profiling.
Controls Protected Audience API running local on-device ad bidding auctions.
Controls enrolling users into remarketing interest groups for targeted campaigns.
Controls Storage Access API unlocking third-party cookie access inside iframes.
Controls querying the complete catalog of locally installed operating system fonts.
Controls synchronous XMLHttpRequest calls which freeze the browser UI main thread.
Controls retrieving WebAuthn credentials and biometric passkeys during login.
Controls registering new public-key credentials and FIDO2 passkeys on domain.
Controls Federated Credential Management (FedCM) identity provider sign-in dialogs.
Controls cross-origin isolation requirements for SharedArrayBuffer and High-Res Timers.
Controls WebXR immersive VR and AR spatial room, head, and hand motion tracking.
Controls Element.requestFullscreen() allowing documents to enter full-screen mode.
Controls automatic autoplay of HTML5 video and audio media elements without tap.
Controls HTMLVideoElement.requestPictureInPicture() for floating media windows.
Controls Encrypted Media Extensions (DRM / Widevine / PlayReady playback).
Controls Screen Wake Lock API preventing mobile displays from sleeping or dimming.
Controls Gamepad API polling button presses and analog thumbsticks on controllers.
Controls navigator.share() invoking native system-level sharing dialogues.
Controls Compute Pressure API providing CPU load and thermal throttling telemetry.
Controls Multi-Screen Window Placement API detecting connected secondary monitors.
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), display-capture=(), usb=(), bluetooth=(), hid=(), serial=(), screen-wake-lock=(), idle-detection=(), browsing-topics=(), run-ad-auction=(), join-ad-interest-group=(), clipboard-read=(), sync-xhr=(), local-fonts=(), midi=(), otp-credentials=(), fullscreen=(self), autoplay=(self), publickey-credentials-get=(self), publickey-credentials-create=(self), encrypted-media=(self)W3C Permissions Policy L1
Compiles modern structured field syntax conforming to official W3C Permissions Policy specifications, replacing deprecated Feature-Policy headers with precise per-origin allowlists.
Zero-Knowledge Client Computation
All policy syntheses, header parses, and cryptographic security audits execute 100% locally in your browser memory. No headers or origin domains are ever sent to remote servers.
Universal Multi-Server Export
Generates copy-paste configurations for Nginx, Apache HTTPD, Caddy Server, Next.js security headers, and HTML iframe allow attributes with instant validation.