# Cookie & Set-Cookie Parser

URL: https://phishdestroy.io/developer-tools/cookie-parser
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Paste a Set-Cookie header value or a Cookie string to see each part as a name and value, with bare attributes such as Secure and HttpOnly marked as (flag).

## Example input

Session cookie

```
__Host-session=3f9a1c2e7b; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=3600
```

Shows six rows: __Host-session = 3f9a1c2e7b, Path = /, Secure (flag), HttpOnly (flag), SameSite = Lax and Max-Age = 3600.

## FAQ

### Does it check whether a cookie is set up securely?

No. It splits the text at semicolons and at the first = of each part; it does not warn about missing Secure, HttpOnly or SameSite, decode values or check the __Host- and __Secure- prefix rules. Paste one cookie at a time and leave out the Set-Cookie: header name.

### Do Secure and HttpOnly stop session theft by phishing?

No. Adversary-in-the-middle phishing kits proxy the real login and receive the session cookie directly, so the stolen cookie works until it expires or is revoked. HttpOnly only blocks reading by page scripts, and Secure only blocks sending over plain HTTP.

### Is the cookie uploaded?

No. Parsing happens in your browser and nothing is sent anywhere. Session cookies grant account access, so do not paste live ones into tools you do not trust.

## Related tools

- [HTTP Headers Reference](https://phishdestroy.io/developer-tools/http-headers-reference)
- [CORS Headers Generator](https://phishdestroy.io/developer-tools/cors-headers-generator)
- [JWT Decoder](https://phishdestroy.io/developer-tools/jwt-decoder)
- [User-Agent Parser](https://phishdestroy.io/developer-tools/user-agent-parser)
- [Basic Auth Header Generator / Decoder](https://phishdestroy.io/developer-tools/basic-auth-header)

All tools: https://phishdestroy.io/developer-tools