Cookie / Set-Cookie Header Builder
Compose a Set-Cookie header from name and value plus the security attributes — SameSite, Secure, HttpOnly, Partitioned, Max-Age — with safety warnings.
Set-Cookie: session=abc123; Path=/; SameSite=Lax; Secure; HttpOnly
Send this header on a response. The browser stores the cookie, and later requests to a matching domain and path carry Cookie: name=value automatically.
How to use
- Start from the preset closest to your use case and tweak from there.
- For a fresh CSRF token, pick the strict preset — SameSite=Strict prevents cross-origin requests from carrying it.
- Third-party embeds need SameSite=None + Secure + Partitioned to land in a Chromium browser today.
About this tool
ShowHide
Builds a Set-Cookie header browsers will actually accept: attributes in the order the specification recommends, spelled the way parsers expect, with no stray trailing semicolon. Presets cover the four shapes that account for most real cookies — a short session cookie, a longer "remember me", a third-party embed cookie carrying SameSite=None, Secure and Partitioned, and a strict CSRF token — and warnings fire on the mistakes that cost the most time to diagnose.
Domain is the attribute that does the opposite of what people expect. Leaving it out produces a host-only cookie, readable at exactly the host that set it. Setting Domain=example.com widens the scope to every subdomain, so the way to restrict a cookie to one host is to omit the attribute, not to name the host. A leading dot is a historical artefact: RFC 6265 tells browsers to ignore it, so .example.com and example.com mean the same thing, and neither is narrower.
SameSite decides whether the cookie rides along on requests started by other sites. Strict sends it only on same-site navigation, Lax adds top-level navigations, which is what modern browsers assume when the attribute is missing, and None sends it everywhere — but only if Secure is also present, or the cookie is rejected outright. Partitioned goes a step further for embedded contexts, giving each top-level site its own separate copy so a cookie set inside one host's page cannot be read from another's.
Three limits are worth having in mind. The __Host- name prefix is enforced by the browser rather than advisory: a cookie named that way is refused unless it is Secure, has Path=/ and has no Domain at all, which makes it the strongest available binding to one origin. Max-Age wins over Expires when both are present. And Chrome caps cookie lifetime at 400 days regardless of what you ask for, so a ten-year cookie is a ten-year cookie nowhere.
Frequently asked questions
Why does SameSite=None need Secure?
Chromium rejects SameSite=None cookies that aren't also Secure — it's the cookie spec's way of forcing third-party cookies onto HTTPS only, where they can't be sniffed by network attackers.
What is the Partitioned attribute?
Partitioned (CHIPS) tells the browser to scope a third-party cookie per top-level site. Without it, Chrome's third-party-cookie phase-out blocks the cookie entirely; with it, your embed still works but each parent site sees its own jar.
How do I actually delete a cookie?
Send the same cookie again with an expiry in the past, and with the same name, path and domain it was set with — those three form its identity. A mismatch in path or domain creates a second cookie instead of removing the first, which is why a login can appear to persist after logout while a duplicate quietly shadows it.
Why does the browser cap what I can store?
Because cookies ride on every matching request, so their size is a per-request cost. Browsers hold roughly 4 KB per cookie and a few dozen per domain, and servers reject oversized header blocks outright — a hard-to-diagnose 400 or 431 from a proxy is often an accumulation of cookies rather than a bad request. Keep an identifier in the cookie and the data on the server.
Related tools
HTTP Cookie Parser
Paste a Cookie: request header or a Set-Cookie: response header and see each cookie's name, value, attributes, and warnings.
Developer
HTTP Headers Reference
Searchable reference for ~50 standard HTTP request, response, CORS, caching, security, and cookie headers.
Developer
Cache-Control Header Builder
Build an HTTP Cache-Control header from a visual checklist — freshness, revalidation, immutability, and the common presets.
Network
HSTS Header Builder
Compose a Strict-Transport-Security header — max-age, includeSubDomains, preload — with a live preload-list eligibility check.
Network
Permissions-Policy Header Builder
Build the Permissions-Policy header: set camera, microphone, geolocation, payment, fullscreen and 20+ other browser features by origin allowlist.
Network
Referrer-Policy Header Builder
Pick a Referrer-Policy value and see exactly what Referer header outbound requests will send — same-origin, cross-origin HTTPS, HTTPS→HTTP downgrade.
Network