What is a Cookie header?

The Cookie header is sent by the browser in HTTP requests to pass stored cookies back to the server. It contains one or more name=value pairs separated by semicolons, e.g. session=abc123; theme=dark.

What is a Set-Cookie header?

The Set-Cookie header is sent by the server in HTTP responses to instruct the browser to store a cookie. It includes the cookie name and value along with optional attributes like Expires, Max-Age, Domain, Path, HttpOnly, Secure, and SameSite.

What does the HttpOnly flag do?

The HttpOnly flag prevents JavaScript from accessing the cookie via document.cookie. This protects session cookies from being stolen through XSS (Cross-Site Scripting) attacks. Always set HttpOnly on session and auth cookies.

What is the SameSite attribute?

SameSite controls whether a cookie is sent with cross-site requests. 'Strict' only sends cookies for same-site requests. 'Lax' allows top-level navigation. 'None' sends cookies on all requests but requires the Secure flag. Modern browsers default to Lax if SameSite is not specified.

Is my cookie data sent to any server?

No. This tool runs entirely in your browser. Your cookie strings never leave your machine. No data is sent to any server.

What is the difference between Expires and Max-Age?

Expires sets an absolute date/time when the cookie expires. Max-Age sets a relative number of seconds from now. Max-Age takes precedence over Expires when both are present. If neither is set, the cookie is a session cookie and expires when the browser tab closes.

Free Cookie Header Debugger

Parse & Debug
Cookie Headers

Paste any Cookie or Set-Cookie header string and see every attribute broken down, validated, and explained — in under 2 seconds.

🍪

Cookie & Set-Cookie

Supports both request Cookie headers and response Set-Cookie headers with full attribute parsing.

🔒

Security Validation

Instantly flags missing Secure, HttpOnly, and SameSite attributes to help harden your session cookies.

⏱️

Human-Readable Expiry

Converts Expires and Max-Age into plain-English time remaining so you know exactly when cookies expire.

Set-Cookie header value

Paste a Set-Cookie header value above to inspect it.

Frequently Asked Questions

Everything you need to know about HTTP Cookie Inspector.

Parse & DebugCookie Headers

Cookie & Set-Cookie

Security Validation

Human-Readable Expiry

Frequently Asked Questions

Parse & Debug
Cookie Headers