Cookie and Set-Cookie Header Parser

Request cookies and response cookies are different

A Cookie request header carries stored name/value pairs back to a server. A Set-Cookie response header creates or updates one cookie and can include attributes such as Path, Domain, Expires, Max-Age, Secure, HttpOnly, and SameSite.

Do not combine multiple Set-Cookie fields with commas. An Expires date itself contains a comma, and the current cookie specification says intermediaries must not fold separate fields into one. Paste one Set-Cookie field per line in this parser.

Example response cookie

Set-Cookie: __Host-session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=3600

The __Host- prefix requires Secure, requires Path=/, and forbids Domain. A __Secure- cookie requires Secure. This tool also flags SameSite=None without Secure, invalid Max-Age values, unrecognized SameSite values, and malformed names.

What the parser can and cannot tell you

The parser preserves values after the first equals sign, because cookie values can contain =. Optional percent decoding is a convenience for applications that encode values; percent encoding is not a universal cookie-value rule.

The report cannot know whether a cookie is appropriate for your authentication design, whether its value is signed or encrypted, whether a browser will block it under privacy policy, or whether its scope is broader than intended. It also does not verify a live response.

For related debugging, inspect a token with the JWT Decoder, sanitize captured network traffic with the HAR Viewer and Sanitizer, or review cross-origin response behavior with the CORS Header Generator.

Sensitive data and privacy

Production cookie headers often contain active session identifiers. Prefer a redacted sample. Parsing happens entirely in this browser tab, and the input is not sent to MiniUtil or included in analytics. Clearing the form removes the value from the page state.

Cookie syntax and behavior are specified by RFC 10025, which obsoletes RFC 6265.