BYTETOOLS

Cookie Parser

Decode a Cookie or Set-Cookie header into names, values and attributes — Domain, Path, Expires, SameSite — with security flags for missing attributes.

What is the Cookie Parser?

The ByteTools Cookie Parser breaks a raw Cookie or Set-Cookie header into a readable table. Set-Cookie lines are split into name, URL-decoded value and every attribute — Domain, Path, Expires (shown as a local date), Max-Age (shown as a human duration), Secure, HttpOnly, SameSite and Partitioned.

  • Parses Set-Cookie attributes: Domain, Path, Expires, Max-Age, Secure, HttpOnly, SameSite, Partitioned
  • Renders Expires as a local date and Max-Age as a human-readable duration
  • Flags missing Secure, HttpOnly and SameSite attributes
  • Validates __Secure- and __Host- cookie-name prefix requirements
  • URL-decodes cookie values automatically
  • 100% client-side — session cookies never leave your browser

How to use the Cookie Parser

  1. 1

    Choose the header type: Set-Cookie (response) or Cookie (request).

  2. 2

    Paste the header value — multiple Set-Cookie lines are fine, one per line.

  3. 3

    Click Parse cookies.

  4. 4

    Review the attribute table, expiry dates and the security flags for each cookie.

About the Cookie Parser

The ByteTools Cookie Parser breaks a raw Cookie or Set-Cookie header into a readable table. Set-Cookie lines are split into name, URL-decoded value and every attribute — Domain, Path, Expires (shown as a local date), Max-Age (shown as a human duration), Secure, HttpOnly, SameSite and Partitioned.

It also audits each cookie's security posture: missing Secure or HttpOnly flags, an absent SameSite attribute, SameSite=None without Secure (which browsers reject), and __Secure- / __Host- prefix rules that are not actually satisfied. Request-style Cookie headers are parsed into a simple name/value list with URL-decoding.

Everything is parsed locally in your browser. Cookies frequently contain session identifiers, so nothing you paste is ever uploaded or stored.

Frequently asked questions

What is the difference between the Cookie and Set-Cookie headers?

Set-Cookie is sent by the server to create a cookie, and it carries attributes like Expires and HttpOnly. Cookie is sent by the browser on later requests and contains only name=value pairs — the attributes are never echoed back.

What does SameSite=Lax mean?

The cookie is sent on same-site requests and on top-level navigations to your site (like clicking a link), but not on cross-site subrequests such as images or iframes. It is the default in modern browsers when SameSite is omitted, and a solid CSRF mitigation.

Why does SameSite=None require Secure?

SameSite=None asks browsers to send the cookie in all cross-site contexts, which is only allowed over HTTPS. Chrome and other browsers reject a SameSite=None cookie without the Secure flag — this parser flags that combination for you.

What do the __Host- and __Secure- prefixes do?

They are enforced by the browser. A __Secure- cookie must have the Secure flag, and a __Host- cookie must additionally have Path=/ and no Domain attribute, which locks it to the exact host that set it. If the attributes do not match the prefix, the browser silently drops the cookie.

What happens if a cookie has both Expires and Max-Age?

Max-Age wins — the HTTP specification says browsers must prefer it when both are present. Expires exists mainly for compatibility with very old clients.

Is it safe to paste real session cookies here?

Parsing is entirely local, so nothing is transmitted or stored by this tool. That said, session cookies grant access to accounts — avoid pasting them on shared machines and clear the field when done.

Related tools