Loading page
About this tool
Compare all eight Referrer-Policy values on a real URL pair and see the exact Referer header each one sends.
The Referrer Policy Chooser applies the W3C Referrer Policy algorithm to a source and destination URL you supply, and prints the exact Referer header each of the eight policy values would produce, including the same-origin and secure-to-insecure downgrade rules. It flags query parameters that look like tokens, session ids or email addresses, because those only escape when a policy sends the full URL. Modern browsers default to strict-origin-when-cross-origin, which sends the full URL within your own origin, the origin alone when leaving it, and nothing at all on a downgrade.
Open Referrer Policy Chooser on AltFTool — it loads instantly in your browser.
Enter "Page the request starts from" and "Destination URL", or click a preset chip such as Third-party script, HTTPS to HTTP, Same-origin link or Outbound user link.
Pick one of the eight values in "Policy to inspect" — strict-origin-when-cross-origin carries a (browser default) suffix — and the W3C algorithm computes the "Referer header sent" for that exact URL pair.
"All eight policies for this navigation" compares every value side by side, and "Where to declare" gives the Response header, Meta tag, Per element and Per link snippets, each with its own Copy button; Copy comparison takes the whole table.
The Referer value is derived from the spec algorithm for your actual URLs, not summarised in prose.
origin and origin-when-cross-origin still send the origin over plain HTTP; the strict variants do not.
Query keys containing token, session, email and similar are called out when a policy would forward them.
strict-origin-when-cross-origin. Chrome, Firefox and Safari all moved to it in 2020-2021, replacing no-referrer-when-downgrade. It sends the full URL for same-origin requests, only the origin cross-origin, and no header at all when a secure page requests an insecure one.
Both trim the referrer to scheme, host and port, but origin still sends it when an HTTPS page requests an HTTP resource, putting your origin on the wire in cleartext. strict-origin drops the header entirely on that downgrade, which is why it is the safer of the two.
Only when the policy sends the full URL — that is unsafe-url, no-referrer-when-downgrade, and the same-origin case of same-origin, origin-when-cross-origin and strict-origin-when-cross-origin. The fragment after the hash is always removed, as are any username and password in the URL.
Use rel="noreferrer" on that anchor, or referrerpolicy="no-referrer" for finer control. rel="noreferrer" also implies noopener, which stops the opened page reaching back through window.opener. A document-wide Referrer-Policy response header is still the right default; the attribute is for exceptions.