Cookie Parser (Cookie & Set-Cookie)
Paste a request Cookie header or a response Set-Cookie line to split it into name, value and attributes. It also flags common mistakes such as SameSite=None without Secure or a broken __Host- prefix. Cookie values can contain session secrets, so they are masked by default. To audit a whole response, use the HTTP Header Analyzer.
🔒 Runs in your browser · Your data is never sent to a server
Notes
- Cookie values can contain session IDs that let someone impersonate a user. Everything is processed in your browser and nothing is sent to a server, but handle real production cookies with care and keep values hidden while screen sharing.
- Auto-detect treats a line as Set-Cookie if it has attributes such as Domain, Path or Secure after the first pair, and as a Cookie header otherwise. A leading "Set-Cookie:" or "Cookie:" always wins.
- Paste one Set-Cookie per line (multiple lines are fine). A Cookie header is a list of "name=value" pairs separated by semicolons.
- Findings follow common browser behavior (RFC 6265bis) and are a guide only; handling can differ between browsers and versions.
Glossary
Set-Cookie
A response header a server uses to tell the browser to store a cookie. After name=value it lists attributes such as Domain, Path, expiry, Secure, HttpOnly and SameSite, separated by semicolons.
Domain / Path
These limit where the cookie is sent. Without Domain the cookie is host-only (just the issuing host); with Domain it is also sent to subdomains. Path matches by URL path prefix.
Expires / Max-Age
Expiry settings. Expires is a date and Max-Age is a number of seconds; Max-Age wins if both are present. A cookie with neither is a session cookie.
Secure / HttpOnly
Secure sends the cookie only over HTTPS. HttpOnly hides it from JavaScript (document.cookie).
SameSite
Controls whether the cookie is sent on cross-site requests. Strict sends it only on same-site requests, Lax also on safe top-level navigations such as link clicks, and None always (Secure required).
Partitioned (CHIPS)
Stores a third-party cookie separately for each top-level site that embeds it. Requires Secure.
__Host- / __Secure- prefixes
Cookie name prefixes that enforce security rules. __Secure- requires Secure; __Host- additionally requires Path=/ and no Domain, preventing subdomains from overwriting it.
FAQ
What is the difference between Cookie and Set-Cookie?
Cookie is the list of name=value pairs a browser sends with a request and carries no attributes. Set-Cookie is the server instruction in a response and can attach Domain, Path, Expires, Secure, HttpOnly, SameSite and more. This tool handles both and can auto-detect which one you pasted.
Which wins when both Expires and Max-Age are set?
Max-Age takes precedence. If Max-Age is 0 or negative, or Expires is in the past, the cookie is treated as a deletion instruction.
Why is my SameSite=None cookie not being stored?
A SameSite=None cookie must also have the Secure attribute, otherwise modern browsers such as Chrome reject it. Make sure the site is served over HTTPS too. This tool flags that combination.
Are the pasted cookie values shown on screen?
By default values are masked except for the first two characters. Turn on "Show cookie values" to see them in full. Input is processed only in your browser and is never sent or stored.
Share this page