HTTP Cookie Parser
Developer
Two modes: `Cookie:` (what the browser sends — just `name=value` pairs) and `Set-Cookie:` (what the server returns — name, value, and attributes like `Path`, `Domain`, `Max-Age`, `Expires`, `SameSite`, `Secure`, `HttpOnly`, `Partitioned`). The parser flags common misconfigurations: `SameSite=None` without `Secure`, `__Secure-` cookies missing `Secure`, and `__Host-` cookies that don't pass the strict requirements.
Name
session_id
Value
abc123def456
Name
theme
Value
dark
Name
locale
Value
ko-KR
Cookie names and values are URL-encoded in practice — the tool shows them as-is.
How to use
- Pick the direction: Cookie (request) or Set-Cookie (response).
- Paste one or more cookies. For Set-Cookie, put one cookie per line.
- Read off the per-cookie cards. Warnings appear on cookies the browser would reject or treat oddly.
Frequently asked questions
- Why is `SameSite=None; Secure` required?
- Modern browsers refuse cross-site cookies without `Secure` since Chrome 80 — if you want third-party-context cookies to be sent, the cookie must travel over HTTPS. The tool flags `SameSite=None` without `Secure` so you catch it before deploying.
- What's a `__Host-` cookie?
- Cookies whose name starts with `__Host-` are subject to stricter rules: the cookie must have `Secure`, must not have a `Domain` attribute, and must have `Path=/`. This makes them strongly host-scoped — convenient for first-party authentication.
- Why are multiple lines needed for Set-Cookie?
- An HTTP response can carry multiple `Set-Cookie` headers, but they can't be merged onto one line because each cookie's value can legitimately contain a comma (e.g. in dates). The tool follows that convention: one cookie per line.
Related tools
JWT Decoder
Decode a JSON Web Token to inspect its header, claims, and expiration.
UUID Generator
Generate random version-4 UUIDs in bulk, with copy.
Hash Generator (SHA)
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text.
URL Encoder / Decoder
Percent-encode text for URLs, or decode encoded URLs back to text.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 back to text, instantly.
JSON Formatter & Validator
Format, beautify, minify, and validate JSON right in your browser.