Cookie & Set-Cookie Parser is a free tool that turns cookie headers into a readable table. For Set-Cookie headers it explains every attribute (expiry, domain, path, Secure, HttpOnly and SameSite) and warns about settings that make browsers reject the cookie or leave it exposed. It runs in your browser.
How to use it
- Copy headers from your browser’s Network tab or from
curl -i. - Paste either a
Cookieheader or one or moreSet-Cookielines. The type is detected automatically. - Review the table and any warnings.
Cookie attributes explained
- Expires / Max-Age: when the cookie is deleted. Without them, it is a session cookie that disappears when the browser closes.
- Domain: if set, the cookie is also sent to subdomains. If left out, only the exact host receives it, which is safer.
- Path: limits the cookie to URLs under this path.
- Secure: only sent over HTTPS.
- HttpOnly: hidden from JavaScript, which protects login cookies from being stolen by XSS.
- SameSite:
Strictnever sends the cookie from other sites,Laxsends it on normal link clicks, andNonealways sends it (and requires Secure).
Cookie name prefixes
Names starting with __Secure- must be Secure; names starting with __Host- must also havePath=/ and no Domain. Browsers enforce these rules, which stops other subdomains from overwriting important cookies. For analysing all response headers, try the HTTP Headers Analyzer.
Frequently asked questions
What is the difference between Cookie and Set-Cookie?
Servers send Set-Cookie in responses to store a cookie, one header per cookie, with attributes such as Expires. Browsers send them back in a single Cookie request header, as name=value pairs only.
Which attributes should a login cookie have?
Secure (HTTPS only), HttpOnly (hidden from JavaScript), SameSite=Lax or Strict, and a reasonable expiry. The parser warns when a session-like cookie is missing these.
Why would a browser reject my cookie?
Common reasons: SameSite=None without Secure, a __Host- prefix without Secure and Path=/, or a Domain that doesn’t match the site.
Last updated