BYTETOOLS

Permissions-Policy Generator

Build a Permissions-Policy header from a checklist of browser features, with the matching iframe allow attribute and the legacy Feature-Policy form.

Set each browser feature to blocked, your own origin, everyone, or a specific list of origins. The header, the matching iframe allow attribute and the legacy Feature-Policy form are all built as you type.

25
Directives in header
9
Fully blocked
25
Available features

accelerometer

Motion sensor readings.

ambient-light-sensor

Ambient light sensor readings.

autoplay

Media that starts playing without a gesture.

batteryno legacy equivalent

Battery Status API.

camera

Video input devices.

clipboard-readno legacy equivalent

Reading the system clipboard.

clipboard-writeno legacy equivalent

Writing to the system clipboard.

display-capture

Screen, window and tab capture.

encrypted-media

DRM-protected media (EME).

fullscreen

requestFullscreen().

geolocation

Precise device location.

gyroscope

Gyroscope readings.

idle-detectionno legacy equivalent

Detecting when the user goes idle.

local-fontsno legacy equivalent

Enumerating locally installed fonts.

magnetometer

Magnetometer readings.

microphone

Audio input devices.

midi

Web MIDI API.

payment

Payment Request API.

picture-in-picture

Picture-in-picture video.

publickey-credentials-getno legacy equivalent

WebAuthn assertions (passkey sign-in).

screen-wake-lockno legacy equivalent

Keeping the screen awake.

serialno legacy equivalent

Web Serial API.

usb

WebUSB API.

web-shareno legacy equivalent

navigator.share().

xr-spatial-trackingno legacy equivalent

WebXR session tracking.

Permissions-Policy header

Permissions-Policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(), clipboard-read=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), geolocation=(), gyroscope=(self), idle-detection=(), local-fonts=(), magnetometer=(self), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), serial=(), usb=(), web-share=(self), xr-spatial-tracking=(self)

Header value only

accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(), clipboard-read=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), geolocation=(), gyroscope=(self), idle-detection=(), local-fonts=(), magnetometer=(self), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), serial=(), usb=(), web-share=(self), xr-spatial-tracking=(self)

Paste this into nginx add_header Permissions-Policy "…";, Apache Header set Permissions-Policy "…", or your framework's header config.

Equivalent iframe allow attribute

<iframe src="https://example.com/embed" allow="accelerometer; ambient-light-sensor; autoplay; battery; clipboard-read; clipboard-write; display-capture; encrypted-media; fullscreen; gyroscope; magnetometer; picture-in-picture; publickey-credentials-get; screen-wake-lock; web-share; xr-spatial-tracking"></iframe>

The allow attribute delegates a feature to an embedded document. A feature blocked by your top-level header can never be re-enabled by an iframe, so the header always wins.

Legacy Feature-Policy header

Feature-Policy: accelerometer 'self'; ambient-light-sensor 'self'; autoplay 'self'; camera 'none'; display-capture 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'none'; gyroscope 'self'; magnetometer 'self'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'self'; usb 'none'

Feature-Policy is deprecated and no current browser needs it. Send it only if you must support very old clients, and note that directives marked "no legacy equivalent" are omitted here because they never existed in that syntax.

What is the Permissions-Policy Generator?

Permissions-Policy is an HTTP header that controls which browser features a page and its iframes may use. Each directive is set to () to block it, (self) for your own origin, * for everyone, or an explicit origin list.

  • 25 directives covering camera, microphone, geolocation, payment, USB, serial and more
  • Blocked, self, wildcard or explicit origin allowlist per directive
  • Correct structured-header quoting, with self left unquoted as the spec requires
  • Matching iframe allow attribute, HTML-escaped and ready to paste
  • Legacy Feature-Policy output with modern-only directives correctly omitted
  • Origin validation with clear errors for malformed entries

How to use the Permissions-Policy Generator

  1. 1

    Start from the privacy-first defaults, or click Block everything and open up only the features you need.

  2. 2

    Set each directive to blocked, your own origin, everyone, or a specific origin list.

  3. 3

    For a custom list, type the origins separated by spaces — use the keyword self for your own origin.

  4. 4

    Toggle between listing every directive and listing only the non-default ones to control header length.

  5. 5

    Copy the header, the header value alone for your server config, or the iframe allow attribute.

About the Permissions-Policy Generator

Permissions-Policy is the successor to Feature-Policy. It lets you switch off browser capabilities your site never uses — camera, microphone, geolocation, USB, serial, payment — so that injected or embedded code cannot reach for them either. This generator builds the header from a checklist of 25 features.

Set each directive to blocked, your own origin, everyone, or a specific list of origins, and the header is rebuilt as you type. You also get the equivalent iframe allow attribute for delegating a feature to an embedded document, and the deprecated Feature-Policy form for very old clients — with directives that never existed in that syntax correctly omitted.

Origins are validated and quoted according to the structured-header syntax the specification requires, which is the detail most hand-written policies get wrong. Start from the privacy-first defaults or block everything and open up only what you need. Nothing is uploaded; the header is assembled locally in your browser.

Frequently asked questions

What does the Permissions-Policy header do?

It tells the browser which powerful features your page and its iframes are allowed to use. Setting camera=() means nothing on the page can request the camera, even if injected script tries — it is a hard limit enforced by the browser itself.

What is the difference between Permissions-Policy and Feature-Policy?

Permissions-Policy is the current standard and Feature-Policy is its deprecated predecessor. The syntax changed: Feature-Policy used semicolons and quoted keywords like 'self', while Permissions-Policy uses commas and parentheses, as in geolocation=(self).

How do I allow a feature for one specific origin?

Choose Specific origins for that directive and enter the full origin, for example https://maps.example.com. The generator quotes it correctly for you — origins must be quoted in the header, but the keyword self must not be.

Can an iframe re-enable a feature my header blocked?

No. The top-level header sets the ceiling, and the iframe allow attribute can only delegate a subset of what is already permitted. If you block camera at the top level, no iframe can turn it back on.

Do I need to list every directive?

No, and a shorter header is easier to maintain. Only list features you actively want to restrict — anything you omit keeps its browser default. Use the toggle above to switch between the full list and only the non-defaults.

Related tools