HTTP Cookie Parser
Two modes: `Cookie:` (what the browser sends — just `name=value` pairs) and `Set-Cookie:` (what the server returns — name, value, and attributes like `Path`, `Domain`, `Max-Age`, `Expires`, `SameSite`, `Secure`, `HttpOnly`, `Partitioned`). The parser flags common misconfigurations: `SameSite=None` without `Secure`, `__Secure-` cookies missing `Secure`, and `__Host-` cookies that don't pass the strict requirements.
Name
session_id
Value
abc123def456
Name
theme
Value
dark
Name
locale
Value
ko-KR
Cookie names and values are URL-encoded in practice — the tool shows them as-is.
How to use
- Pick the direction: Cookie (request) or Set-Cookie (response).
- Paste one or more cookies. For Set-Cookie, put one cookie per line.
- Read off the per-cookie cards. Warnings appear on cookies the browser would reject or treat oddly.
Frequently asked questions
- Why is `SameSite=None; Secure` required?
- Modern browsers refuse cross-site cookies without `Secure` since Chrome 80 — if you want third-party-context cookies to be sent, the cookie must travel over HTTPS. The tool flags `SameSite=None` without `Secure` so you catch it before deploying.
- What's a `__Host-` cookie?
- Cookies whose name starts with `__Host-` are subject to stricter rules: the cookie must have `Secure`, must not have a `Domain` attribute, and must have `Path=/`. This makes them strongly host-scoped — convenient for first-party authentication.
- Why are multiple lines needed for Set-Cookie?
- An HTTP response can carry multiple `Set-Cookie` headers, but they can't be merged onto one line because each cookie's value can legitimately contain a comma (e.g. in dates). The tool follows that convention: one cookie per line.
Related tools
Cookie / Set-Cookie Header Builder
Compose a `Set-Cookie` response header from name/value plus the security attributes — SameSite, Secure, HttpOnly, Partitioned, Max-Age — with safety warnings.
HTTP Headers Reference
Searchable reference for ~50 standard HTTP request, response, CORS, caching, security, and cookie headers.
HTTP Basic Auth Encoder / Decoder
Encode `username:password` into the Base64 `Authorization: Basic` header — or paste an existing header back to see who's in it.
Cache-Control Header Builder
Build an HTTP Cache-Control header from a visual checklist — freshness, revalidation, immutability, and the common presets.
JWT Decoder
Decode a JSON Web Token to inspect its header, claims, and expiration.
HTTP Methods Reference
Quick card per HTTP method (GET, POST, PUT, DELETE, PATCH, …) — safety, idempotence, cacheability, and whether request / response bodies are allowed.