🔒 Runs in your browser — nothing is uploaded✓ Free, no signup
Cookie & Set-Cookie Parser
Paste a Cookie request header, document.cookie or Set-Cookie response headers to see every cookie decoded, with expiry times and security warnings.
Cookie or Set-Cookie header
4 cookies
| Name | Value (decoded) | |
|---|---|---|
| session_id | 8f2a1c9e7b | |
| theme | dark | |
| cart | {"items":3}raw: %7B%22items%22%3A3%7D | |
| _ga | GA1.2.1234567890.1700000000 |
JSON
{
"session_id": "8f2a1c9e7b",
"theme": "dark",
"cart": "{\"items\":3}",
"_ga": "GA1.2.1234567890.1700000000"
}When should you use the Cookie Parser?
- Debugging login and session problems
- Reading cookies copied from DevTools or a HAR file
- Checking Set-Cookie attributes like SameSite and Secure before release
How to use the Cookie Parser
- 1
Paste cookies
A Cookie header, document.cookie output, or Set-Cookie headers (one per line).
- 2
Check the type
The header type is detected automatically, or choose it yourself.
- 3
Read the results
Values are URL-decoded; Max-Age and Expires are shown as durations.
- 4
Fix warnings
Missing Secure, HttpOnly or SameSite problems are flagged.
Examples
Cookie header
Header
Cookie: session=abc%20def; theme=dark
Parsed
session abc def theme dark
Common errors and how to fix them
SameSite=None requires Secure- Browsers reject SameSite=None cookies that aren't Secure. Add the Secure attribute and serve over HTTPS.
Several Set-Cookie headers were merged- Put each Set-Cookie header on its own line — they can't be split on commas because Expires dates contain commas.
More from Web & Network
Free tools that run in your browser — no signup, nothing uploaded.
URL Parser & Query String Parser
Break a URL into protocol, host, path, query parameters and hash.
IP Address Converter
Convert IPv4 between dotted, decimal, hex and binary, and expand IPv6.
HTTP Status Codes List
Every HTTP status code explained in plain English — searchable.
User Agent Parser & Checker
See your user agent and parse any UA string into browser, OS and device.
IP Subnet / CIDR Calculator
Calculate network, broadcast, host range and mask for any IPv4 CIDR.
Meta Tag & Open Graph Generator
Generate SEO meta tags, Open Graph and X card tags with live previews.
CORS & Security Headers Generator
Generate CORS and security headers for Nginx, Apache, Express, Next.js and more.
What Is My Screen Resolution?
See your screen resolution, viewport size and device pixel ratio instantly.
JavaScript Keycode Finder
Press any key to see its event.key, event.code and keyCode.
Cookie Parser FAQ
Set-Cookie is sent by the server to create a cookie, with attributes like Path and Expires. Cookie is sent by the browser back to the server and contains only name=value pairs.
It controls whether the cookie is sent with cross-site requests: Strict (never), Lax (top-level navigation only — the default) or None (always, but requires Secure).
It hides the cookie from JavaScript (document.cookie), which protects session cookies from theft by XSS.
Both set a lifetime. Max-Age (seconds) takes priority. Without either, the cookie is deleted when the browser session ends.
Name prefixes that make browsers enforce rules: __Secure- requires Secure; __Host- also requires Path=/ and no Domain.
No. Everything runs in your browser, so your cookies never leaves your device.