Cookie Inspector - Decode a Set-Cookie Header Online
Cookie Inspector
Decode Any Set-Cookie Header String
Understanding Set-Cookie Attributes
Security Review
Verify a session cookie is properly marked Secure, HttpOnly, and SameSite before shipping to production.
Debugging Auth Issues
Inspect why a cookie isn't persisting by checking its Domain, Path, and Expires values.
API Development
Confirm a backend's raw Set-Cookie header matches your intended configuration during development.
Local Processing
Your cookie data never leaves your browser — parsing runs entirely client-side.
Why Cookie Attributes Matter
Secure ensures a cookie is only sent over HTTPS, HttpOnly blocks JavaScript from reading it (mitigating XSS-based theft), and SameSite controls whether it's sent on cross-site requests (mitigating CSRF). A misconfigured Set-Cookie header — missing Secure on a session cookie, for example — is one of the most common web application security gaps, so being able to quickly decode and verify one is a valuable habit.
Key Takeaways
- Full Attribute Breakdown: Decodes Expires, Max-Age, Domain, Path, Secure, HttpOnly, and SameSite.
- Header String, Not Live Cookies: Paste a raw Set-Cookie header — this tool doesn't read the current page's live cookies.
- Client-Side Only: All parsing happens locally in your browser — no data is ever sent to a server.