Cookie / Set-Cookie Header Builder
Builds the `Set-Cookie` header browsers will accept, ordered the way the spec recommends and with every attribute named correctly (PascalCase, no trailing semicolon). Presets cover the four shapes you write 90% of the time: a short-lived session cookie, a longer 'remember me', a third-party embed cookie (SameSite=None + Secure + Partitioned), and a strict CSRF token. The tool also warns about the footguns that bite people the most — SameSite=None without Secure, leading dots on Domain, and HttpOnly on cookies you'll need from JavaScript.
Set-Cookie: session=abc123; Path=/; SameSite=Lax; Secure; HttpOnly
Emit this on a response. The browser stores the cookie; the next request to the matching domain+path sends `Cookie: name=value` automatically.
How to use
- Start from the preset closest to your use case and tweak from there.
- For a fresh CSRF token, pick the strict preset — SameSite=Strict prevents cross-origin requests from carrying it.
- Third-party embeds need SameSite=None + Secure + Partitioned to land in a Chromium browser today.
Frequently asked questions
- Why does SameSite=None need Secure?
- Chromium rejects SameSite=None cookies that aren't also Secure — it's the cookie spec's way of forcing third-party cookies onto HTTPS only, where they can't be sniffed by network attackers.
- What is the Partitioned attribute?
- Partitioned (CHIPS) tells the browser to scope a third-party cookie per top-level site. Without it, Chrome's third-party-cookie phase-out blocks the cookie entirely; with it, your embed still works but each parent site sees its own jar.
Related tools
HTTP Cookie Parser
Paste a `Cookie:` request header or a `Set-Cookie:` response header and see each cookie's name, value, attributes, and warnings.
HTTP Headers Reference
Searchable reference for ~50 standard HTTP request, response, CORS, caching, security, and cookie headers.
Cache-Control Header Builder
Build an HTTP Cache-Control header from a visual checklist — freshness, revalidation, immutability, and the common presets.
HSTS Header Builder
Compose a Strict-Transport-Security header — max-age, includeSubDomains, preload — with a live preload-list eligibility check.
Permissions-Policy Header Builder
Build the `Permissions-Policy` response header — toggle camera, microphone, geolocation, payment, fullscreen and 20+ other browser features by origin allowlist.
Referrer-Policy Header Builder
Pick a Referrer-Policy value and see exactly what `Referer` header outbound requests will send — same-origin, cross-origin HTTPS, HTTPS→HTTP downgrade.