What does the validator check?
It checks directive syntax, feature names, origin formatting, duplicate entries and potentially broad allowlists.
Security
Permissions Policy Validator
Validate Permissions-Policy header syntax, directives, origins and allowlists.
Tool
Permissions Policy Validator
Validate Permissions-Policy header syntax, directives, origins and allowlists.
This tool runs in your browser. Your input is processed locally and is not uploaded.
About this Tool
Use this Permissions Policy validator to inspect an existing header before deployment. The tool checks feature names, allowlists, origin syntax, duplicate directives and overly broad permissions locally in your browser.
Examples
- camera=(), microphone=()
- geolocation=(self), payment=()
- fullscreen=(self "https://example.com")
Frequently Asked Questions
Does a valid policy guarantee security?
No. A policy may be syntactically valid but still allow more browser capabilities than the application requires.
Can deprecated feature names be detected?
Yes. A browser-side rule list can flag known deprecated or unsupported feature directives without contacting a server.