Cookie parser and security check
Parse Cookie and Set-Cookie headers and check expiry, scope and security attributes.
Input limit: 16 KiB.
Use copied headers only. This tool does not contact the header origin or read browser cookies.
Structured Cookie result
| Name | Value | Domain | Path | Expires/Max-Age | SameSite | Secure | HttpOnly | Partitioned | Attributes |
|---|---|---|---|---|---|---|---|---|---|
| Waiting for input | |||||||||
Redacted JSON / Redacted report
Redacted JSON
Redacted report
Cookie guidance
Request header limits
A Cookie request header contains only name/value pairs, so response attributes must be reviewed from Set-Cookie lines.
Value handling
Values are hidden by default and can only be revealed per row. Report and JSON output stay redacted.
Scope review
Broad Domain, missing Path, and repeated names can change which cookie is sent or overwritten.
Attribute review
Secure, HttpOnly, SameSite, Partitioned, and prefix rules are checked as local parsing hints, not as a site-wide audit.
Official references
Related tools
HTTP security header checkerPaste HTTP response headers to check security policies, missing headers and cookie attributes.CORS response header analyzerCheck whether a cross-origin request is allowed using its origin, method and response headers.Hash calculatorCalculate SHA-1, SHA-256, SHA-384 and SHA-512 digests and compare them with an expected hash.HMAC and webhook signature debuggerCalculate HMAC values and check webhook signatures using presets for GitHub, Stripe, Slack and other platforms.