Referrer-Policy Builder
Builds the Referrer-Policy header from a standard value (strict-origin, no-referrer, etc.).
Controlling what your browser tells the next site
You want to leak less information to the sites people reach by clicking links on yours, but writing the header itself is where you stall: the spec defines eight values, and the gap between strict-origin and strict-origin-when-cross-origin is not obvious from the names. This page handles the mechanical part. Type the value, get back a line you can paste into Nginx, Cloudflare or an Express middleware.
Under the hood it is a list check and nothing more. Whatever you type is compared against the eight tokens from the spec: no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin and unsafe-url. A match produces the Referrer-Policy line; anything else produces a warning instead. Worth knowing: the field label only lists six of those, but origin-when-cross-origin and unsafe-url are accepted too.
One thing catches people out. The spec allows a comma separated fallback list, and this validator rejects that, because it compares against a single token. If you need a fallback, write the line by hand. Also think about where the value lands, since the scope differs: an HTTP header covers the whole site, the name=referrer meta tag covers that one document, and the referrerpolicy attribute covers a single link or iframe. Everything runs in your browser; the tool builds a string and never probes your site.
Frequently asked questions
Which value should I pick when in doubt?
Why did I get a warning instead of a header?
Does it check whether my site already sends the header?
Related Tools
Permissions-Policy Builder
Builds the Permissions-Policy header from a list of feature=allowlist entries (e.g. geolocation=()).
Basic CSP Evaluator
Evaluates a Content-Security-Policy directive reporting unsafe-inline, unsafe-eval or wildcard issues.
CORS Config Validator
Validate a CORS configuration (allowed origins or *), checking the format and duplicates. Useful for safely configuring APIs and web servers.
HSTS Header Builder
Assembles a Strict-Transport-Security header line from a max-age in seconds plus optional includeSubDomains and preload directives, ready to paste into a config.
HSTS Header Builder
Builds the Strict-Transport-Security header with max-age, includeSubDomains and preload as selected.
COOP / COEP Headers Builder
Generate the COOP and COEP HTTP headers (Cross-Origin Opener/Embedder Policy) to isolate your origin. Required to safely use features like SharedArrayBuffer.