What replaced Feature-Policy?

Permissions-Policy is the current standard; Feature-Policy is deprecated.

What does an empty () mean?

It blocks the feature for every origin, including your own site.

Where do I add the header?

In your web server or CDN response headers for all HTML documents.

Is my data uploaded to a server?

No. This tool runs entirely in your browser using standard web APIs, so your input never leaves your device and nothing is logged or stored on our servers.

Does it work offline and on mobile?

Yes. Once the page has loaded it keeps working without a network connection, and the layout is responsive so it stays usable on phones and tablets.

Permissions-Policy Header Generator

Build a Permissions-Policy header controlling camera, geolocation and more.

Support

Works Offline

Privacy First

No Login

No API

Features

accelerometer

autoplay

camera

clipboard-write

display-capture

encrypted-media

fullscreen

geolocation

gyroscope

microphone

midi

payment

picture-in-picture

usb

Generated header

Permissions-Policy: accelerometer=(), autoplay=(), camera=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), microphone=(), midi=(), payment=(), picture-in-picture=(), usb=()

Nginx snippet

add_header Permissions-Policy "accelerometer=(), autoplay=(), camera=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), microphone=(), midi=(), payment=(), picture-in-picture=(), usb=()" always;

About the Permissions-Policy Header Generator

Toggle each browser feature between blocked, self-only, allow-all or a custom origin list to build a valid Permissions-Policy header, plus a ready Nginx snippet.

Examples

Example

camera blocked, geolocation self

Output

Permissions-Policy: camera=(), geolocation=(self)

Keyboard shortcuts

Copy the main outputCtrl / ⌘ + Shift + C
Download the resultCtrl / ⌘ + S
Share this toolCtrl / ⌘ + Shift + S
Reset the inputsAlt + R
Open the tool search paletteCtrl / ⌘ + K

Related tools

Security Headers Auditor

Security

Grade HTTP response headers against security best practices.

CORS Config Generator

Security

Generate CORS headers/config for Nginx, Apache, Express, or Workers.

CSP Builder

Security

Build a Content-Security-Policy header from per-directive sources.

Referrer Policy Generator

Security

Pick a Referrer-Policy value and get header/meta/server snippets.

Robots.txt Security Checker

Security

Scan robots.txt for accidental disclosure of sensitive paths.

X-Frame-Options / Clickjacking Checker

Security

Check if X-Frame-Options and CSP frame-ancestors block framing.

Frequently asked questions

Version 1.0.0 · Updated 2026-08-09 · Runs entirely in your browser