Cookie header parser
This cookie header parser reads a Cookie request header or Set-Cookie response lines and explains each part. Web developers use it to debug login sessions, check SameSite and Secure settings, and see why a browser might reject a cookie.
- Runs in your browser
- Free, no account needed
- Copy or download the result
Result
Example
Set-Cookie: sid=31d4d96e407aad42; Path=/; Secure; HttpOnly; SameSite=Lax Set-Cookie: tracking=xyz; Domain=.example.com; Max-Age=31536000; SameSite=None
Set-Cookie lines: 2 Cookie 1: sid Value: 31d4d96e407aad42 Domain: not set (host-only: sent only to the exact host that set it) Path: / Secure: yes, HTTPS only HttpOnly: yes, hidden from JavaScript SameSite: Lax Partitioned: no Lifetime: session cookie (removed when the browser session ends) Cookie 2: tracking Value: xyz Max-Age: 31536000 seconds (365 days) Domain: example.com (also sent to its subdomains; the leading dot is ignored) Path: not set (defaults to the directory of the request URL) Secure: no HttpOnly: no, readable by JavaScript SameSite: None Partitioned: no Lifetime: persistent for 365 days Warnings: - SameSite=None without Secure. Modern browsers reject this cookie.
How to use the cookie header parser
- Paste a Cookie header line, or one Set-Cookie line per row, into the input box.
- Leave Header type on Detect automatically, or pick Cookie request header or Set-Cookie lines.
- Press Run.
- Read the attributes and warnings, then use Copy result or Download.
How it works
Set-Cookie lines show Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite and Partitioned, and say when Max-Age overrides Expires.
Warnings cover SameSite=None without Secure, Partitioned without Secure, the __Secure- and __Host- name prefix rules, invalid SameSite values, Expires dates already past by your device clock and Max-Age over 400 days.
A Cookie request header is split on semicolons into a name and value table, and repeated names are flagged.
Set-Cookie names containing spaces or separator characters are rejected, and invalid names in a Cookie header are flagged.
Everything runs in your browser. Your input is not uploaded or stored.
Questions and answers
Why is my SameSite=None cookie rejected?
Browsers require the Secure attribute with SameSite=None. Add Secure and serve the site over HTTPS.
What is the difference between Expires and Max-Age?
Expires sets a date and Max-Age sets a number of seconds from now. If both are present, browsers use Max-Age.
What does HttpOnly do?
It hides the cookie from JavaScript, so a script injected into the page cannot read it. The browser still sends it with requests.
What is a Partitioned cookie?
It is a cookie stored separately for each top-level site, which lets embedded content keep state without cross-site tracking. It must also be Secure.