Skip to content

HTTP & API tools / FREE ONLINE TOOL

Cookie & Set-Cookie Parser

Parses Cookie and Set-Cookie headers, explains every attribute and flags insecure or broken cookies.

Your cookie stays on this device

This tool runs entirely inside your web browser. Your cookie is processed on your own device and is never sent to our servers. How this works

Cookie & Set-Cookie Parser is a free tool that turns cookie headers into a readable table. For Set-Cookie headers it explains every attribute (expiry, domain, path, Secure, HttpOnly and SameSite) and warns about settings that make browsers reject the cookie or leave it exposed. It runs in your browser.

How to use it

  1. Copy headers from your browser’s Network tab or from curl -i.
  2. Paste either a Cookie header or one or more Set-Cookie lines. The type is detected automatically.
  3. Review the table and any warnings.

Cookie attributes explained

  • Expires / Max-Age: when the cookie is deleted. Without them, it is a session cookie that disappears when the browser closes.
  • Domain: if set, the cookie is also sent to subdomains. If left out, only the exact host receives it, which is safer.
  • Path: limits the cookie to URLs under this path.
  • Secure: only sent over HTTPS.
  • HttpOnly: hidden from JavaScript, which protects login cookies from being stolen by XSS.
  • SameSite: Strict never sends the cookie from other sites, Lax sends it on normal link clicks, and None always sends it (and requires Secure).

Cookie name prefixes

Names starting with __Secure- must be Secure; names starting with __Host- must also havePath=/ and no Domain. Browsers enforce these rules, which stops other subdomains from overwriting important cookies. For analysing all response headers, try the HTTP Headers Analyzer.

Frequently asked questions

What is the difference between Cookie and Set-Cookie?

Servers send Set-Cookie in responses to store a cookie, one header per cookie, with attributes such as Expires. Browsers send them back in a single Cookie request header, as name=value pairs only.

Which attributes should a login cookie have?

Secure (HTTPS only), HttpOnly (hidden from JavaScript), SameSite=Lax or Strict, and a reasonable expiry. The parser warns when a session-like cookie is missing these.

Why would a browser reject my cookie?

Common reasons: SameSite=None without Secure, a __Host- prefix without Secure and Path=/, or a Domain that doesn’t match the site.

Last updated

KEEP GOING

Headers Analyzer

Explains HTTP response headers and checks for missing security headers and version leaks.

JWT Decoder

Decodes a JSON Web Token to show its header and claims, explains each claim, and tells you if it has expired.

URL Parser

Breaks a URL into its parts and decodes every query parameter, flagging tracking parameters.

Base64 Decode

Converts Base64 back into readable text, or into the original file (such as an image or PDF) when it is not text.

Missing a feature, or need a tool we don’t have? Suggest it.