ToolJovia
Developer

Permissions Policy Workbench

Build or inspect supported Permissions-Policy headers and iframe allow grammar.

✓ Browser-local processing

Loading tool…

How to use Permissions Policy Workbench

Build or inspect supported Permissions-Policy headers and iframe allow grammar. Explicit allowlists are parsed as data, with duplicate directives and malformed origins rejected. The report separates response-header grammar from iframe allow syntax and flags features outside its small reference set.

  1. Provide policy json, header or iframe allow value.
  2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
  3. Copy the result or download a separate output; reset to clear the current form.

Good to know

  • 10,000 characters,100 directives and30 allowlist entries per feature. Serialized HTTP(S) origins only; host wildcards, escaped structured strings and field parameters are outside the supported subset. Header self is a token; iframe self/src/none require single quotes.
  • No policy is applied. Effective ancestor/delegation behavior, defaults, feature availability and browser support are not simulated.
  • Inputs are processed on this device and are not automatically saved or uploaded.

Common questions

Can I reuse iframe allow syntax as a header?

They differ. Header origins are quoted and empty parentheses deny a feature; iframe allow supports source/self/none keywords and uses semicolon-separated declarations. Choose the correct context.

Does this change my original input?

No. The tool returns a separate result. Review that output before using it in another application.

Keep going with related tools

All developer →
Developer

CSP Policy Builder

Build a conservative Content-Security-Policy response header using exact HTTPS source origins.

SEO

Content Security Policy Auditor

Inspect an existing CSP for duplicate directives and specific source-expression risks.

Developer

HTTP Header Workbench

Parse ordered HTTP fields or export a validated JSON header list.

Developer

HTTP Structured Fields Workbench

Parse and canonically serialize RFC9651 Items, Lists and Dictionaries with typed values.