Cookie Parser & Inspector
Parse Set-Cookie or Cookie headers into name, value, attributes and warnings, or build a Set-Cookie header from a form.
About this tool
Every web request carries small key/value strings called cookies. The server sends them with a Set-Cookie response header (one cookie per line, with attributes like Domain, Path, Expires, Secure, HttpOnly and SameSite); the browser echoes them back with a single Cookie request header containing name1=value1; name2=value2. This tool parses either form, decodes URL-encoded values, and shows every attribute with a human-readable expiry.
Example: paste session=abc123; Domain=example.com; Path=/; Expires=Wed, 09 Jun 2027 10:18:14 GMT; Secure; HttpOnly; SameSite=Lax and the parser shows the name/value, decoded value, all six attributes, the time-until-expiry in days, and any warnings (missing flags, SameSite=None without Secure, etc.). Switch to Build mode to do the reverse: fill in a form and the tool emits a valid Set-Cookie header ready to paste into your server config.
Useful when debugging auth flows, debugging why a session cookie is being rejected, building a login response by hand, or inspecting a third-party tracking cookie from your browser's network tab.
FAQ
What is the difference between the Cookie and Set-Cookie header? ›
Set-Cookie is sent by the server in an HTTP response and carries the full cookie definition including attributes (Domain, Path, Expires, Secure, HttpOnly, SameSite). Cookie is sent by the browser in subsequent requests and contains only name=value pairs separated by semicolons — never the attributes.
Why is my cookie being rejected by the browser? ›
The three most common causes are: SameSite=None without Secure (modern browsers reject this), a Domain attribute that does not match the responding host (you cannot set cookies for a domain you do not control), or a Path that does not cover the page setting it. This tool flags the first two automatically.
What does HttpOnly actually do? ›
HttpOnly makes the cookie inaccessible to JavaScript via document.cookie, which prevents cross-site scripting (XSS) from stealing session tokens. Session cookies should almost always carry HttpOnly; the only reason to omit it is when your own JavaScript needs to read the value.
How does Max-Age interact with Expires? ›
Both control when the cookie is deleted. Max-Age is a duration in seconds from now; Expires is an absolute date. When both are present, modern browsers use Max-Age. A negative or zero Max-Age deletes the cookie immediately — useful for logging users out.
Does this tool send any data anywhere? ›
No. Parsing happens entirely in your browser; nothing about the cookie is transmitted. You can safely paste session tokens here.