HTTP Cookie Parser
Parse HTTP Cookie and Set-Cookie headers. Extracts name, value, domain, path, expiry, HttpOnly, Secure, and SameSite attributes.
About HTTP Cookie Parser
HTTP cookies are sent in two header formats. The Cookie request header carries one or more name=value pairs separated by semicolons. The Set-Cookie response header carries a single cookie along with directives like Domain, Path, Expires, Max-Age, HttpOnly, Secure, and SameSite. This parser automatically detects both formats and displays the attributes in a structured table or JSON representation.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Reading a Set-Cookie header's attributes to see why a cookie is not persisting.
- Checking whether a cookie carries HttpOnly and Secure as intended.
- Working out a cookie's actual expiry from a header.
- Auditing a response's cookies during a security review.
- Splitting a long Cookie header into individual name-value pairs.
Frequently Asked Questions
- What is the difference between a Cookie and a Set-Cookie header?
- Direction. The server sends `Set-Cookie`, one per cookie, with all the attributes. The browser sends `Cookie` back, carrying only names and values separated by `; ` — no attributes at all, which is why you cannot tell from a request whether a cookie was Secure.
- What does SameSite actually do?
- It decides whether the cookie rides along on a cross-site request. `Strict` never sends it from another site, `Lax` sends it on top-level navigations only, and `None` always sends it — but `None` is rejected unless `Secure` is also set.
- Does HttpOnly stop XSS?
- No, but it limits the damage: `document.cookie` cannot read the value, so injected script cannot exfiltrate a session token directly. The script can still *use* the session by making requests from the page, so HttpOnly is mitigation, not a fix.
- Which wins, Expires or Max-Age?
- `Max-Age`, where both are present — and it is the safer one, being relative to now rather than depending on the client's clock being right. A cookie with neither is a session cookie and dies with the browser process.
- Why is my cookie not being sent?
- Usually Domain or Path. A cookie set for `app.example.com` is not sent to `example.com`, and one with `Path=/admin` is not sent to `/`. After that, check Secure over plain HTTP, SameSite on a cross-site request, and the 4 KB size limit per cookie.
- What are the __Host- and __Secure- prefixes?
- Naming conventions browsers enforce. `__Secure-` requires the Secure flag; `__Host-` additionally requires Path=/ and forbids Domain, which locks the cookie to the exact host. They are a cheap defence against a subdomain overwriting a session cookie.
Common errors and gotchas
- Confusing the Cookie request header with the Set-Cookie response header, which have different syntax.
- Assuming a missing SameSite means None, when browsers now default to Lax.
- Reading a Domain attribute as restricting to that host, when it widens to subdomains.
- Overlooking that a cookie without Expires or Max-Age is a session cookie.
- Treating the Path attribute as a security boundary, which it is not.
Related Developer Utilities tools
RegExp Tester
Test regular expressions and inspect matches locally.
Regex Visualizer
Visual regex pattern diagram with live match highlighting and capture group annotations.
Subnet Calculator
Compute CIDR subnets, usable hosts, and network ranges.
Cron Parser
Translate cron syntax into plain English.
URL Parser
Break a URL into protocol, host, path, and query parts.
HTML Previewer
Paste HTML and see it rendered live in a safe, sandboxed preview.
HTTP Status Code Reference
Search and look up every HTTP status code and its meaning.
MIME Type Lookup
Find the MIME type for a file extension, or the extensions for a MIME type.