Paste a Cookie header, Set-Cookie header, or curl command and instantly see all cookie attributes in a readable table.
Paste a Cookie header, Set-Cookie header, or curl command and instantly see all cookie attributes in a readable table.
This cookie parser online parses HTTP cookie strings and displays cookie names, values, and attributes (Secure, HttpOnly, SameSite, Domain, Path, Expires, Max-Age). Paste a Cookie or Set-Cookie header and view the result instantly. You can also build Set-Cookie strings.
Input:
sessionId=abc123; Secure; HttpOnly; SameSite=Lax
Output (parsed):
{
sessionId: "abc123",
Secure: true,
HttpOnly: true,
SameSite: "Lax"
}The Cookie Parser helps web developers work with HTTP cookies and Set-Cookie headers. It parses both browser cookie strings (multiple name=value pairs) and Set-Cookie header format (one cookie with Path, Domain, Expires, Secure, HttpOnly, SameSite, etc.), decodes values, and lets you build valid Set-Cookie strings. All processing runs in your browser—no server, no storage.
Paste your cookie string into the input box. The tool auto-detects the format:
sessionId=abc123; theme=dark; csrftoken=xyz. Each name=value pair is one cookie.sessionId=abc123; Path=/; Secure; HttpOnly; SameSite=Lax. The first pair is the cookie name and value; the rest are attributes (Path, Domain, Expires, Max-Age, Secure, HttpOnly, SameSite).Values are URL-decoded automatically (e.g. user=John%20Doe → John Doe). If a value is valid JSON, a “Show JSON” preview is available.
.example.com)./ or /api).Multiple cookies (browser format):
sessionId=abc123; theme=dark; csrftoken=xyz
Single Set-Cookie header:
sessionId=abc123; Path=/; Max-Age=3600; Secure; HttpOnly; SameSite=Lax
Set-Cookie is an HTTP response header sent by the server to create or update a cookie in the browser. It contains the cookie name and value plus optional attributes (Path, Domain, Expires, Max-Age, Secure, HttpOnly, SameSite). The browser stores the cookie and sends it back with future requests that match the Domain and Path. This tool parses Set-Cookie strings and can generate them for use in your backend or API responses.
Developers use this cookie parser to inspect cookies from the Application tab (Chrome) or Storage tab (Firefox), or from the Cookie request/response headers in the Network panel. Paste the cookie string or a Set-Cookie header, then use the statistics panel to see counts (Secure, HttpOnly, SameSite), search and sort the table, and copy individual Set-Cookie headers for replay or debugging. Validation warnings highlight common issues like SameSite=None without Secure or invalid Expires format.
Browser cookie string (e.g. from document.cookie or dev tools) contains multiple cookies as name=value; name2=value2. There are no attributes like Path or Domain—those are stored by the browser separately. Set-Cookie header is what the server sends in an HTTP response: one cookie per header, with optional attributes (Path=, Domain=, Expires=, Max-Age=, Secure, HttpOnly, SameSite=). This tool detects the format automatically and parses accordingly.
This cookie parser supports multiple input formats. Paste any of the following and the tool will detect the format and parse the cookies automatically.
-H "Cookie: ..." or -H 'Cookie: ...'; the tool extracts the cookie value from the command.Examples:
Step-by-step chains that connect related tools for common tasks.
Advertisement
A Set-Cookie header has the format: name=value; Path=/; Expires=date; HttpOnly; Secure; SameSite=Lax. Paste the full header value (without the 'Set-Cookie:' prefix) and this tool extracts name, value, domain, path, expires, and all flags as a structured table. Useful for debugging authentication flows and session management.
HttpOnly prevents JavaScript from reading the cookie via document.cookie — protecting against XSS token theft. Secure means the cookie is only sent over HTTPS connections. Both attributes should be set on session and auth cookies in production. SameSite=Strict or Lax also prevents CSRF attacks by restricting cross-site cookie sending.
document.cookie only shows name=value pairs for cookies accessible to JavaScript (HttpOnly cookies are excluded). The Set-Cookie header includes all attributes (path, expiry, flags). This parser handles both formats — paste either the HTTP header value or the document.cookie string.
Use the form editor to set name, value, domain, path, expiry, and flags, then copy the generated Set-Cookie header. This is useful when you need to manually set a cookie for a test case, Postman request, or API integration that expects specific cookie attributes.
Part of Developer Tools
More free tools for the same workflow.
Free Base64 encoder and decoder — encode any text or data to Base64 and decode Base64 strings back to readable text. Supports URL-safe Base64 variant. No signup needed.
Free HTTP header generator — build Content-Type, Cache-Control, CORS, Authorization, and security headers with correct syntax. Copy for NGINX, Apache, or API responses. No signup.
Advertisement