Referrer-Policy Header Builder
Referrer-Policy Header Builder: Validates W3C Referrer Policy specification directives and outputs standard HTTP response header.
About this referrer-policy header builder
Referrer-Policy Header Builder — browser-based utility.
How this tool works
Implements client-side Referrer-Policy Header Builder operations. Validates W3C Referrer Policy specification directives and outputs standard HTTP response header specifically designed for a website developer builds a referrer-policy header to prevent leakage of internal query parameters.
- Token Structure Extraction: Splits JWT strings on '.' delimiters into Header, Payload, and Signature segments.
- Base64URL Decoding: Decodes URL-safe Base64 segments into raw JSON strings without executing unverified signature payloads.
- Claims Parsing & Timestamp Evaluation: Parses registered claims ('exp', 'nbf', 'iat', 'iss', 'aud') and checks current clock validity.
- Cryptographic Status Reporting: Displays token signature algorithm (RS256, HS256, ES256, EdDSA) and warns that client decoding does not verify cryptographic signatures without the public key.
Worked example
Scenario: Build the documented matrix for strict-origin-when-cross-origin.
Sample input:
Processing: Validate one of eight allowed directives and render HTTP header, meta tag, and three-context matrix.
Illustrative output:
Limits and verification
Rejects strings that do not contain exactly two '.' delimiters. Explicitly informs the user that client-side decoding inspects token claims but CANNOT verify mathematical signature validity unless the corresponding public key/secret is supplied.
Examples demonstrate an expected workflow; they do not prove every input or every branch of an external specification. Check important results with an independent source before using them for money, security, compliance, safety, or irreversible file changes.
Browser processing boundary
Tool input is processed by code running in the browser and is not intentionally sent to a CZOA processing API. The page can still request ordinary site assets, analytics, or advertising when those services are enabled. Browser extensions and managed-device software remain outside this tool's control.
Relevant references
These references govern or help explain the format, protocol, or calculation used here. Listing a reference does not claim certification or complete implementation of every optional feature.
Content owner: CZOA Tools · Last reviewed: 2026-09-15 · Review methodology
How to use it
- Enter, paste, or select your input data into the Referrer-Policy Header Builder workspace controls.
- Review available parameter fields, units, formats, or options configured for your task.
- Click the action button or observe immediate live calculations rendered in your browser runtime.
- Inspect the resulting output and any diagnostic messages, then copy or download the result if needed.
Frequently asked questions
Which Referrer-Policy values are accepted?+
The primary text accepts exactly eight recognized directives, including no-referrer, origin, same-origin, strict-origin and strict-origin-when-cross-origin; blank input defaults to strict-origin-when-cross-origin.
What does the page generate?+
It emits the selected policy, an HTTP Referrer-Policy header, a meta tag, and a same-origin/cross-origin/downgrade matrix showing whether the page model sends a full URL, origin, or none.
What did the tested browser result establish?+
For strict-origin-when-cross-origin, the frozen page returned its matching header, full URL for same origin, origin for cross origin, and none on downgrade. This validates the page’s local matrix for that directive.
What cannot this matrix guarantee?+
It does not inspect a live navigation, browser extensions, redirects, element referrerpolicy attributes, server headers, user-agent quirks, or other controls that can alter an actual request.