Cookie Parser
Parse Cookie and Set-Cookie headers — attributes, flags, expiry. Edit and rebuild. 100% client-side.
99 chars
#1session_idValid
Expires in 1 day
🔗 Rebuilt Set-Cookie header
session_id=abc123def456; Domain=.example.com; Path=/; Max-Age=86400; Secure; HttpOnly; SameSite=Lax
🔒 100% private: All parsing happens in your browser. Your cookies (especially session tokens) never leave your device.
About Cookie Parser
Cookies are small pieces of data that websites store in the browser to track sessions, authentication, preferences, and analytics. Two HTTP headers handle them: "Cookie" (sent by the browser to the server) and "Set-Cookie" (sent by the server to the browser). Set-Cookie headers include attributes like Domain, Path, Expires, Max-Age, Secure, HttpOnly, and SameSite that control how and when the cookie is used. Debugging cookies manually is tedious — dates, booleans, and special characters blend together in a single line. This tool parses any Cookie or Set-Cookie header into a clean table, shows expiry time in human-readable form, highlights security flags, and lets you edit and rebuild the header.
How It Works
- Paste a Cookie or Set-Cookie header into the input box.
- See each cookie parsed into name, value, domain, path, expiry, and flags.
- Edit any attribute, add or remove cookies.
- See the rebuilt header live — ready to copy.
✨ Key Features
- ✓Parse Cookie headers (name=value; name2=value2)
- ✓Parse Set-Cookie headers (with attributes)
- ✓Auto-detect header type
- ✓Show Domain, Path, Expires, Max-Age
- ✓Human-readable expiry ("in 3 days" or "expired")
- ✓Highlight Secure, HttpOnly, SameSite flags
- ✓Edit attributes and rebuild header
- ✓Add or remove cookies
- ✓Copy individual or rebuilt headers
- ✓100% client-side — no data sent to any server
🎯 Common Use Cases
- →Debugging session and authentication cookies
- →Inspecting Set-Cookie headers from API responses
- →Understanding SameSite and security flags
- →Checking cookie expiry during QA testing
- →Verifying CSRF token cookies
- →Analyzing third-party tracking cookies
- →Building Set-Cookie headers for tests
- →Learning HTTP cookie attributes
💡 Advanced Tips & Pro Insights
- ▸Secure: cookie is only sent over HTTPS. HttpOnly: cookie is not accessible via JavaScript (protects against XSS). SameSite: controls cross-site sending (Strict, Lax, None).
- ▸SameSite=None requires Secure — browsers reject SameSite=None without Secure over HTTPS.
- ▸Max-Age is in seconds and takes precedence over Expires. If Max-Age=0, the cookie is deleted immediately.
- ▸Session cookies (no Expires/Max-Age) are deleted when the browser closes.
- ▸Domain=.example.com makes the cookie available to all subdomains; without a Domain, the cookie is host-only.
Frequently Asked Questions
Is this cookie parser free?▾
Yes, this cookie parser is completely free with no signup, email, or usage limits.
Is my data safe?▾
Yes, 100% safe. All parsing happens in your browser. Your cookies are never sent to any server — critical for cookies that may contain session tokens.
What is the difference between Cookie and Set-Cookie?▾
Cookie (singular) is sent by the browser to the server and contains only name=value pairs. Set-Cookie is sent by the server to the browser and includes attributes like Domain, Path, Expires, Secure, HttpOnly, and SameSite.
What does Secure mean?▾
Secure means the cookie is only sent over HTTPS connections. Cookies with Secure are never sent over plain HTTP, protecting against network eavesdropping.
What does HttpOnly mean?▾
HttpOnly means the cookie cannot be accessed by JavaScript (document.cookie). This protects against XSS attacks that try to steal session cookies.
What are SameSite values?▾
SameSite=Strict: cookie is not sent on cross-site requests. Lax (default in modern browsers): sent on top-level navigation. None: sent on all cross-site requests (requires Secure).
What is the difference between Max-Age and Expires?▾
Max-Age is in seconds from now (relative). Expires is an absolute date. Max-Age takes precedence if both are present. Max-Age=0 deletes the cookie.
Why do some cookies have long random strings?▾
Those are typically session IDs or tokens. They are usually long random values so they cannot be guessed by attackers. Never share real session cookies — this tool never sends data to any server.