Cookie Decoder

An HTTP Cookie (web cookie, browser cookie) is a small piece of data sent from a server to a user's web browser. The browser stores the cookie and sends it back with subsequent requests to the same server, enabling stateful behavior in the stateless HTTP protocol.

Cookies are defined in RFC 6265 and are used for session management, personalization, tracking, and authentication. The Set-Cookie header is sent by the server to create cookies, and the Cookie header is sent by the browser to return them.

Cookie Attributes

• Domain — Specifies which hosts can receive the cookie
• Path — Limits the cookie to a specific URL path
• Expires / Max-Age — Sets the cookie's lifetime (session vs persistent)
• Secure — Cookie is only sent over HTTPS connections
• HttpOnly — Cookie is inaccessible to JavaScript (prevents XSS theft)
• SameSite — Controls cross-site request behavior (Lax, Strict, None)

1. Parse cookies — Paste a cookie string (from Cookie or Set-Cookie header) in the left panel, then click Parse to see all cookies and their attributes in a table.
2. Build a cookie — Fill in the cookie name, value, and optional attributes on the right panel, then click Build to generate a Set-Cookie header string.
3. The tool supports both simple Cookie header format (key=value; key2=value2) and full Set-Cookie format with attributes.

• Debugging authentication — Inspect session cookies and auth tokens to troubleshoot login issues.
• API development — Parse Set-Cookie headers from API responses during development and testing.
• Security analysis — Check if cookies have proper Secure, HttpOnly, and SameSite attributes.
• Web scraping — Parse cookies from scraped pages to maintain sessions across requests.
• Cookie testing — Generate accurate Set-Cookie headers for testing cookie handling in browsers.