HTTP Cookie Parser & Generator

Paste a Set-Cookie header (or a multi-line stack of them) and see every attribute broken out. Or paste a document.cookie string to extract the name / value pairs the browser is currently exposing. The Generator tab builds a Set-Cookie from a form and lints for the RFC 6265 mistakes that cause the browser to silently drop a cookie: SameSite=None without Secure, __Host- with Path ≠ /, non-integer Max-Age, and more. Pure client-side, no upload.

—

Input One Set-Cookie header per line, or a single document.cookie string.

Paste a Set-Cookie header to begin.

Name Value Domain Path Max-Age (seconds) SameSite Secure HttpOnly

Set-Cookie

—

Findings —

Fill in the fields above to see lint findings.

Common cookie patterns Click an example to load it into the Parse tab.

Name	Description	Example	Action
Loading…

Attribute reference

Domain: The host the cookie is sent to. Leading dots are ignored by modern browsers. Omit to scope to the issuing host only (recommended).
Path: URL prefix that must match for the cookie to be sent. Default is the path of the request that set it. Use / for site-wide.
Expires: Absolute expiry as a Wdy, DD Mon YYYY HH:MM:SS GMT date (e.g. Wed, 21 Oct 2026 07:28:00 GMT). Bounded by the 32-bit Unix-time limit on some clients.
Max-Age: Lifetime in seconds from the moment the cookie is set. Takes precedence over Expires when both are present. Omit both for a session cookie.
Secure: Only send the cookie over HTTPS. Required for SameSite=None and for the __Secure- / __Host- name prefixes.
HttpOnly: Hide the cookie from document.cookie and from JavaScript. Required for session cookies to be reasonably XSS-resistant.
SameSite: Strict = never sent on cross-site requests. Lax = sent on top-level GET navigations. None = always sent (requires Secure). Default is implementation-defined — set it explicitly.

How the parser works

Tokenisation. Input is split on ; with surrounding whitespace trimmed. The first segment is the name=value pair; subsequent segments are attributes.
Quoted values. If the value is wrapped in "…" the quotes are stripped for storage but preserved when re-emitted (since the wire format requires them).
Attribute canonicalisation. Names are matched case-insensitively against the seven known attributes (Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite) and stored under their canonical case. SameSite values are normalised to title case.
document.cookie parsing uses the browser's contract: values are percent-decoded, attributes are not preserved (the browser keeps them internally and exposes only the names / values).
Generator order. Re-emitted Set-Cookie attributes follow the spec-friendly order: Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite, then any unknown attributes alphabetically.
Nothing leaves the browser. The tool runs entirely on a small script; the headers you paste never get uploaded.