Search 26 common HTTP request and response headers with a one-line purpose each
Cookie & Set-Cookie Parser
Runs locally
Use Cookie & Set-Cookie Parser
What it does
Paste a Set-Cookie header value or a Cookie string to see each part as a name and value, with bare attributes such as Secure and HttpOnly marked as (flag).
It runs entirely in your browser: nothing you enter is uploaded.
Example
Session cookie
__Host-session=3f9a1c2e7b; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=3600ATTRIBUTE VALUE
__Host-session 3f9a1c2e7b
Path /
Secure (flag)
HttpOnly (flag)
SameSite Lax
Max-Age 3600Shows six rows: __Host-session = 3f9a1c2e7b, Path = /, Secure (flag), HttpOnly (flag), SameSite = Lax and Max-Age = 3600.
FAQ
Does it check whether a cookie is set up securely?
No. It splits the text at semicolons and at the first = of each part; it does not warn about missing Secure, HttpOnly or SameSite, decode values or check the __Host- and __Secure- prefix rules. Paste one cookie at a time and leave out the Set-Cookie: header name.
Do Secure and HttpOnly stop session theft by phishing?
No. Adversary-in-the-middle phishing kits proxy the real login and receive the session cookie directly, so the stolen cookie works until it expires or is revoked. HttpOnly only blocks reading by page scripts, and Secure only blocks sending over plain HTTP.
Is the cookie uploaded?
No. Parsing happens in your browser and nothing is sent anywhere. Session cookies grant account access, so do not paste live ones into tools you do not trust.