How browser permissions work
Short answer
When a site wants your camera, microphone, location, notifications, or clipboard, the browser asks. You can allow or block, and the browser remembers. Typical settings live under Chrome’s Privacy and security, Firefox’s Privacy and Security, and Safari’s Websites. Labels move between versions. A prompt is a question, not an order.
A website can ask to use the camera, the microphone, your location, notifications, or the clipboard. The browser is the part that decides whether that happens. It shows a prompt, you answer, and it remembers. Later you can change the answer or set the site back to "ask again."
That prompt is a question, not an order. A page in large letters saying you must click Allow is still only asking. Block is a finished answer. Close is a finished answer. You can allow a site you chose, such as a video class, and refuse a site you opened by accident.
This guide stays at that level. It explains what the common prompts are for, where the memory lives, and how passwords relate to a different idea, the hash. It does not explain how to bypass a prompt, hide from a school device, or read someone else’s clipboard. More on secrets sits under <a href="/blog/topic/security/">passwords and randomness</a>.
A prompt is a question
The page can beg, explain, or refuse to continue. None of that replaces the browser’s buttons. If a quiz, a news article, or a download insists on your camera, block it. If you joined a call on purpose, allowing the camera and microphone for that visit is reasonable. You can return the site to "ask" after class.
A lock, a camera, or a tune icon in the address bar is often a shortcut to the choice you already made. The icon’s picture moves between versions. It is still a view of the browser’s memory, which is the memory that counts. A button inside the webpage that says "reset permissions" is not that memory unless you know it opened the browser’s own panel.
School devices
If the laptop or the browser is managed by your school, some switches may be locked. That lock is the school’s rule. Do not try to get around it. Ask a teacher when a class site cannot see the camera. On a device you share at home, decide the prompts with a parent, especially for location and the microphone.
Camera and microphone
Sites use the camera and microphone for calls, for a recording you meant to make, and sometimes for a science demo in the browser. A page you are only reading does not need either one. Allow them for the call. If you will not be back tomorrow, choose the one-visit wording when you see it.
Muting inside the call is a second switch. The browser permission says the site may use the hardware. The mute button says you are not sending sound right now. Use both. When the call ends, glance at the address-bar icon. If you wanted a one-time allow and the browser stored a lasting allow, set it back.
You can cover a laptop camera with a sticker or a sliding cover if the device is yours. That is a physical backup. It does not replace the permission choice, and you should not put tape on a school device without permission.
Location
Maps, a weather page you opened for your town, and a shop finder are ordinary reasons to share a place. An article, a quiz, or a "download faster" button are ordinary reasons to refuse. A location can point at home or school. Treat it as personal even when the map on screen looks harmless.
Some browsers offer a precise place and a coarser one, such as a city. The labels differ, and they move. If you only need a region, choose the coarser choice when it appears. If the only choices are allow and block, block is available, and you can allow later for a site you trust.
In Chrome, Google’s help explains that the browser can ask a location service for an estimate and then share that estimate with the site you allowed. Other browsers use their own methods. The result you should picture is the same: the site learns a place. Read who you are handing it to. A site you do not recognise does not get that estimate.
The operating system has a location switch too. If the computer itself has location turned off, the browser cannot invent a precise fix. You may see a message pointing at system settings. Turning location on for the whole computer is a bigger decision than allowing one map. Ask a parent on a shared machine.
Notifications and the clipboard
A page may ask again in its own words after you choose block. Ignore the page. The browser’s block stands until you change it.
Clipboard read and clipboard write
The clipboard is the short-term memory of copy and paste. A site may ask to write to it, so a "copy code" button can place text there when you click. A site may ask to read it, so it can see what you last copied. Reading is the sensitive direction. The last item might be a message, an address, or a password.
You can refuse both. If a paste button fails because you refused, you can still copy and paste yourself with the keyboard or the menu. That is enough for homework.
How the browser remembers
For each site and each feature, the memory is usually one of three states. Allow means the site can use the feature without a fresh question, until you change it or the browser clears it. Block means the browser refuses. Ask, or prompt, means you will see the question the next time the site tries.
A page can look up that state. The Permissions API, described in browser documentation, lets a site ask whether a feature is already granted, denied, or still waiting for you. Looking up the state does not turn the camera on. The prompt appears when the page actually tries to use the feature, and the browser draws that prompt. You answer it.
Sites can also send a Permissions-Policy header. That header is the site’s own rule about which features the page, including a frame embedded inside it, is willing to use. If the header refuses the camera, the browser can treat the permission as denied and skip the prompt. The header cannot overrule your block. A site that wants the camera after you chose block does not get the camera.
Changing your mind is a settings job, not a secret code. Browser documentation has dropped the idea that a page should revoke permissions for you through a special call. Use the menus below. Google’s Chrome help also says Chrome can remove permissions from sites you have not used in a while, so a site you allowed last term may ask again. Treat the new prompt as a new question. Other browsers keep their own schedules.
A new day does not clear the list. A flight does not clear the list. The <a href="/world-clock/">world clock</a> will tell you when a school meeting starts in the school’s zone. It will not reset a permission. If a message says "allow notifications now or you will miss a 4 p.m. meeting," check the clock, then decide whether you even know the site. Urgency is not a reason to press Allow.
Typical menus, and why the words move
On a computer, these paths are typical. Labels move between versions, so if a menu is missing, use the settings search and type camera, microphone, location, notifications, or clipboard.
Phones use different words. Search the browser’s menu or the phone’s settings for the feature name. The choice is the same idea: this site, this hardware, allow or block.
If a class exercise hands you a small JSON file of site names and states, the <a href="/json-formatter/">JSON formatter</a> makes the brackets readable so you can see allow and block on separate lines. Do not put passwords in that file. The formatter checks shape. It does not make a site safe.
Write a short note if you need a parent or a teacher to look with you. The <a href="/word-counter/">word counter</a> keeps the note to a paragraph: which site, which feature, what you already chose.
Leave a managed school browser’s locked rows alone. Ask. On your own device, unknown sites can go back to ask or to block.
Passwords, hashes, and chats
Permissions and passwords solve different problems. A permission is a yes or no about hardware and notifications. A password is a secret that proves you may open an account. They meet in one bad habit: pasting the secret into the wrong box. The login field on the real site is the right box. A chat, a comment form, and a "hash this for me" page are the wrong boxes.
Use a different password on each account. The <a href="/password-generator/">password generator</a> builds one you do not have to invent, and <a href="/blog/how-to-create-a-strong-password/">how to create a strong password</a> explains length and why reuse hurts. Store them in a manager if you have one. Writing them in a school chat "so you remember" publishes them to everyone in that chat.
SHA-256 is a hash. A hash is a one-way fingerprint. The same input produces the same fingerprint, and a tiny change in the input produces a very different fingerprint. You do not decrypt a SHA-256 hash to get the password back. That one-way design is the point. Encryption is a different tool: with the key, the original can be recovered. <a href="/blog/what-is-sha256/">What is SHA-256?</a> walks through the fingerprint idea.
Do not paste a real password into a website to "see the hash." You would be giving the secret to that site. If a class needs a demo, use a silly phrase your teacher suggests, never an account password.
A safe practice
On a device you control, open the typical site-settings page for your browser. Look at camera, microphone, and location. For any site you do not recognise, set it to block or back to ask. If the browser is managed by school, stop at the locked rows and ask the teacher.
If you copied a password recently, copy the word "done" so the clipboard is clear. Do not paste that password anywhere except a login field you meant to open.
The next time a prompt appears, read it as a question. Choose the one-visit allow for a call you trust, and block for a page that only wants your attention. Check the world clock if a message is rushing you with a meeting time. The permission list will still be there tomorrow, until you decide to change it.
Frequently asked questions
If a page says I must click Allow, do I have to?
The page can ask. The browser is where you answer. Allow, block, and close are all real answers, and block is a complete one. A video call you chose to join is a fair reason to allow the camera for that visit. A quiz or an article is a fair reason to block. You can change the choice later in site settings.
Where do I turn a permission off later?
On a computer, typical paths are Chrome Settings, then Privacy and security, then Site settings; Firefox Settings, then Privacy and Security, then Permissions; and Safari Settings, then Websites. Labels move between versions. If a menu is missing, search settings for camera, location, or notifications. A school-managed browser may lock the list.
What is the difference between a hash and encryption?
A hash such as SHA-256 is a one-way fingerprint. The same input gives the same fingerprint, and you do not decrypt that fingerprint to recover a password. Encryption is built so someone with the key can turn the protected text back into the original. Sites often store a password hash. That is different from a lockbox.
Can a website read my clipboard without asking?
Treat clipboard access as a permission. A site may ask to read what you copied or to write text when you press a button. Reading is the sensitive direction, because the clipboard may hold a message or a password. You can refuse. After you paste a password into a login field, copy a harmless word so it does not stay there.
Do permissions reset at midnight or when I travel?
The browser remembers allow and block until you change them, clear them, or the browser drops old choices for sites you have not visited in a long time. A new day or a new time zone does not reset the list. Use site settings to put a site back to ask. Use a world clock for school times, not for permission decisions.
