Cookie Security Analyzer
Paste Set-Cookie headers and see what browsers will keep or reject, with Secure, HttpOnly, SameSite, prefix and lifetime checks.
Runs in your browser Your input never leaves your device.
| Cookie | Browser | Secure | HttpOnly | SameSite | Scope | Lifetime | Bytes |
|---|
How browsers are checked
Where the written draft and Chrome differ, this tool follows Chrome, because that is what most visitors run. The differences: the last copy of an attribute wins even when its value is invalid (the draft keeps the earlier valid one); a Max-Age with a leading plus sign is accepted; dates need whole numeric day, year and time tokens; years before 1601 are parsed as long past instead of invalid; any control character, including a tab inside a name or value, makes Chrome drop the cookie; a name-less cookie whose value contains = is dropped.
Chrome limits a cookie to 400 days; a longer Max-Age or Expires is cut to that. A Secure cookie is accepted over plain http only for localhost, 127.0.0.1 and *.localhost, which browsers treat as secure contexts.
Names and values that look like sessions, tokens or emails are guesses and are labelled as heuristics.
Everything is read in your browser. Nothing you paste is uploaded or stored.
Report a problem with this tool
About this tool
A cookie header looks simple, but browsers apply many rules to it, and a header that looks fine can be thrown away or weakened without any error. This tool reads pasted Set-Cookie headers with the cookie parsing rules of the RFC 6265bis draft (name and value split at the first equals sign, whitespace trimmed, attribute names in any case, unknown attributes kept, the last copy of an attribute wins, Max-Age beating Expires, tolerant date formats, a leading dot removed from Domain, the default Path taken from the request path, and the 4096 byte limit on name plus value) and then decides, for each cookie, whether a browser stores it, rejects it or uses it to delete an old cookie. It reports why: SameSite=None or Partitioned without Secure, a __Host- cookie that has a Domain or no explicit Path=/, a __Secure- cookie without Secure, a Secure cookie from a plain http page, a Domain that does not cover the host or is a public suffix such as co.uk, a control character, or a value that is too large. It then lists risks with a severity, a plain explanation and a fix: missing Secure, HttpOnly or SameSite, a Domain that shares the cookie with every subdomain, a session-looking cookie that lives for weeks, JWTs, random-looking tokens and email addresses in a cookie that scripts can read, duplicate names with different scopes, unknown or misspelled attributes, and lifetimes that the browser cuts to 400 days. Judgements based on the name or look of a value are marked as heuristics. You can also paste a Cookie request header from DevTools or a whole raw HTTP response; a request header carries only names and values, so it gets the limited checks. Where the written draft and Chrome differ, the tool follows Chrome, because every decision was compared with what Chrome 153 actually stored for more than 250 test headers. Give the site scheme and host to get the checks that depend on them. Nothing you paste leaves your browser.
How to use it
- Paste Set-Cookie headers, a raw HTTP response, or a Cookie request header.
- Optionally choose http or https and enter the host that sent the cookies, so Secure and Domain can be checked against the site.
- Press Analyze cookies and read the table and the card for each cookie.
- Press Copy Markdown report to paste the result into a ticket or a pull request.
Common problems
- My cookie is not stored in the browser
- Open its card: the first finding names the rule that failed. The usual causes are SameSite=None without Secure, a Secure cookie set over http, a __Host- cookie with a Domain or no Path=/, a Domain that does not match the page host, and a Max-Age of zero.
- It says only name and value are visible
- A Cookie request header never carries attributes. Copy the Set-Cookie headers from the response (DevTools, Network, the response headers), or read the Application tab.
- The tool flags a cookie as a session cookie but it is not
- Session and token detection is a guess from the name and value and is labelled as a heuristic. Ignore those findings for cookies that hold only a preference.