Cookie Parser

A Set-Cookie header or a document.cookie string looks like one solid piece of text at first glance, but it's actually made of a name, a value, and several security attributes (Secure, HttpOnly, SameSite, and more). This tool breaks the string down into its parts and flags common configuration issues.

How to use it

• Paste a Set-Cookie header from a server response, or a document.cookie string from the browser console.
• The tool lists the name, value, and every attribute (Path, Domain, Expires, Max-Age, Secure, HttpOnly, SameSite) separately.
• Common mistakes — missing Secure on an HTTPS site, SameSite=None without Secure, and so on — are flagged with a warning.

Common uses

• Debugging why a cookie isn't being set or isn't sent on later requests.
• Checking a session cookie's security configuration before shipping (is HttpOnly, Secure, SameSite actually set).
• Reading a complex document.cookie string with multiple values while debugging the frontend.

Things to keep in mind

An HttpOnly cookie is invisible to document.cookie in JavaScript — that's a deliberate XSS defense, and analyzing such a cookie needs the actual Set-Cookie header from a network request instead.

SameSite=None requires the Secure attribute — modern browsers reject such a cookie without it.