Network/HTTP
Cookie Parser
Parse a Set-Cookie header or a Cookie/document.cookie string into name, value, attributes, and a check for common security mistakes.
A Set-Cookie header or a document.cookie string looks like one solid piece of text at first glance, but it's actually made of a name, a value, and several security attributes (Secure, HttpOnly, SameSite, and more). This tool breaks the string down into its parts and flags common configuration issues.
How to use it
- Paste a Set-Cookie header from a server response, or a document.cookie string from the browser console.
- The tool lists the name, value, and every attribute (Path, Domain, Expires, Max-Age, Secure, HttpOnly, SameSite) separately.
- Common mistakes — missing Secure on an HTTPS site, SameSite=None without Secure, and so on — are flagged with a warning.
Common uses
- Debugging why a cookie isn't being set or isn't sent on later requests.
- Checking a session cookie's security configuration before shipping (is HttpOnly, Secure, SameSite actually set).
- Reading a complex document.cookie string with multiple values while debugging the frontend.
Things to keep in mind
An HttpOnly cookie is invisible to document.cookie in JavaScript — that's a deliberate XSS defense, and analyzing such a cookie needs the actual Set-Cookie header from a network request instead.
SameSite=None requires the Secure attribute — modern browsers reject such a cookie without it.
Article about this tool: Cookies: how a small piece of text keeps track of session state
Frequently asked questions
What do the Secure, HttpOnly, and SameSite attributes actually control?
Secure restricts the cookie to HTTPS connections, HttpOnly blocks access from JavaScript (helping prevent XSS theft), and SameSite controls whether the cookie is sent along with cross-site requests.
Why does a cookie string sometimes contain multiple cookies separated by semicolons?
The Cookie request header can carry several name=value pairs from the same domain in one string, while the Set-Cookie response header sets one cookie per header instance, each with its own attributes.
Is my cookie data sent anywhere when I parse it here?
No. Parsing happens entirely in your browser — nothing is uploaded to a server.
What does the Partitioned attribute mean?
It's part of the CHIPS initiative, letting a cookie set inside an embedded iframe have a separate version per parent site — a compromise between blocking third-party cookies entirely and the old cross-site tracking model.
How many cookies can be stored for one domain?
Browsers typically cap it at around 50-180 cookies per domain and about 4KB per cookie — exact limits vary by browser, so you shouldn't rely on cookies to store large amounts of data.