Loading page
About this tool
Compare all eight Referrer-Policy values on a real URL pair and see the exact Referer header each one sends.
This chooser applies the W3C Referrer Policy algorithm to a source and destination URL you supply, and prints the exact Referer header each of the eight policy values would produce, including the same-origin and secure-to-insecure downgrade rules. It flags query parameters that look like tokens, session ids or email addresses, because those only escape when a policy sends the full URL. Modern browsers default to strict-origin-when-cross-origin, which sends the full URL within your own origin, the origin alone when leaving it, and nothing at all on a downgrade.
Open Referrer Policy Chooser on AltFTool — it loads instantly in your browser.
Paste your code or data sample into the workspace.
Pick the format, conversion, or analysis you need.
Copy the polished result straight back into your project.
The Referer value is derived from the spec algorithm for your actual URLs, not summarised in prose.
origin and origin-when-cross-origin still send the origin over plain HTTP; the strict variants do not.
Query keys containing token, session, email and similar are called out when a policy would forward them.
strict-origin-when-cross-origin. Chrome, Firefox and Safari all moved to it in 2020-2021, replacing no-referrer-when-downgrade. It sends the full URL for same-origin requests, only the origin cross-origin, and no header at all when a secure page requests an insecure one.
Both trim the referrer to scheme, host and port, but origin still sends it when an HTTPS page requests an HTTP resource, putting your origin on the wire in cleartext. strict-origin drops the header entirely on that downgrade, which is why it is the safer of the two.
Only when the policy sends the full URL — that is unsafe-url, no-referrer-when-downgrade, and the same-origin case of same-origin, origin-when-cross-origin and strict-origin-when-cross-origin. The fragment after the hash is always removed, as are any username and password in the URL.
Use rel="noreferrer" on that anchor, or referrerpolicy="no-referrer" for finer control. rel="noreferrer" also implies noopener, which stops the opened page reaching back through window.opener. A document-wide Referrer-Policy response header is still the right default; the attribute is for exceptions.