What's the modern browser default?

strict-origin-when-cross-origin is the default in most current browsers if no policy is set.

Which policy is most private?

no-referrer sends no referrer information at all, but destination sites lose all attribution data.

Can I set this via meta tag instead of a header?

Yes, both are generated; the header takes precedence when both are present.

Is my data uploaded to a server?

No. This tool runs entirely in your browser using standard web APIs, so your input never leaves your device and nothing is logged or stored on our servers.

Does it work offline and on mobile?

Yes. Once the page has loaded it keeps working without a network connection, and the layout is responsive so it stays usable on phones and tablets.

Referrer Policy Generator

Pick a Referrer-Policy value and get header/meta/server snippets.

Support

Works Offline

Privacy First

No Login

No API

Choose a Referrer-Policy

Policy

strict-origin-when-cross-origin (modern browser default)

Sends the full URL for same-origin requests, only the origin for cross-origin requests, and nothing when downgrading to HTTP.

Generated snippets

HTTP header

Referrer-Policy: strict-origin-when-cross-origin

HTML meta tag

<meta name="referrer" content="strict-origin-when-cross-origin">

Nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

About the Referrer Policy Generator

Choose a Referrer-Policy value with a plain-English explanation of exactly what referrer information leaks to destination sites, then get ready-to-use HTTP header, HTML meta tag, Nginx, and Apache snippets.

Examples

Strict policy

strict-origin-when-cross-origin

Output

Referrer-Policy: strict-origin-when-cross-origin

Keyboard shortcuts

Copy the main outputCtrl / ⌘ + Shift + C
Download the resultCtrl / ⌘ + S
Share this toolCtrl / ⌘ + Shift + S
Reset the inputsAlt + R
Open the tool search paletteCtrl / ⌘ + K

Related tools

CORS Config Generator

Security

Generate CORS headers/config for Nginx, Apache, Express, or Workers.

CSP Builder

Security

Build a Content-Security-Policy header from per-directive sources.

Permissions-Policy Header Generator

Security

Build a Permissions-Policy header controlling camera, geolocation and more.

Robots.txt Security Checker

Security

Scan robots.txt for accidental disclosure of sensitive paths.

Security Headers Auditor

Security

Grade HTTP response headers against security best practices.

X-Frame-Options / Clickjacking Checker

Security

Check if X-Frame-Options and CSP frame-ancestors block framing.

Frequently asked questions

Version 1.0.0 · Updated 2026-08-10 · Runs entirely in your browser