Skip to content
ToolQivo

Cookie Parser

Parse Set-Cookie and Cookie headers, and check the security flags.

Developer Tools Reviews Free · no sign-up

Quick Tool Overview

The Cookie Parser splits a Set-Cookie header into its name, decoded value and every attribute, then reviews the security flags — including the __Host- and __Secure- prefix rules browsers enforce silently.

What it does
Parses cookie headers and checks their security
You give it
A Set-Cookie or Cookie header
You get back
Attributes, flags and a security assessment
Best for
Debugging sessions and auditing cookie settings
Developer Tools Free, unlimited use No sign-up Runs in your browser

About the Cookie Parser

Paste a Set-Cookie header and it is pulled apart into the cookie name, its decoded value, and every attribute: Domain, Path, Expires, Max-Age, SameSite and the flags. A plain Cookie header, which carries many cookies and no attributes, is recognised and split as well.

The security review is the point. A cookie without Secure travels over plain HTTP. One without HttpOnly can be read by any script on the page, which is how a session is stolen. A missing SameSite now defaults to Lax but should be explicit. SameSite=None without Secure is rejected outright by browsers. The __Host- and __Secure- prefixes impose extra rules that browsers enforce silently, and those are checked too.

Key features of the Cookie Parser

Both header types

Set-Cookie carries one cookie and its attributes; Cookie carries many and none. The parser tells which it received and splits accordingly.

Flags assessed, not listed

Missing Secure, missing HttpOnly and a missing SameSite each get an explanation of what they expose.

Prefix rules checked

__Host- requires Secure, Path=/ and no Domain; __Secure- requires Secure. Browsers silently reject cookies that break those, and this catches it.

SameSite=None validated

It requires Secure, and a cookie missing it is rejected outright — a failure that is otherwise invisible.

Values decoded

Percent-encoded cookie values are decoded, so you can read what is actually stored.

How to use the Cookie Parser

  1. 1

    Paste a header

    A Set-Cookie line, or a whole Cookie header of name=value pairs.

  2. 2

    Read the attributes

    Every attribute is listed with what it does, and expiry dates are made readable.

  3. 3

    Check the security flags

    Secure, HttpOnly and SameSite are each assessed rather than just reported.

  4. 4

    Verify the prefix rules

    If the name starts with __Host- or __Secure-, the extra requirements are checked.

Frequently asked questions

It controls whether the cookie is sent on requests from other sites. Strict never sends it cross-site, Lax sends it on top-level navigations only, and None always sends it but requires Secure.

Reviews of the Cookie Parser

What people who use the Cookie Parser think of it. Reviews come from visitors and are posted as written.

No ratings yet

Yours would be the first.

  • 5 0 reviews rated 5 stars
  • 4 0 reviews rated 4 stars
  • 3 0 reviews rated 3 stars
  • 2 0 reviews rated 2 stars
  • 1 0 reviews rated 1 star

Write a review

Used this tool? Your rating helps the next person decide.

Your rating

Plain text only — links, email addresses and HTML are not accepted. Your name and review are shown publicly; nothing else is collected. See the privacy policy.

0 reviews

Newest first

No reviews yet

Be the first to rate the Cookie Parser. It takes half a minute and no account.

Write the first review

More developer tools