Cookie / Set-Cookie header parser and builder
Cookies are the standard way to keep a session and user preferences in the browser. The Cookie header (browser to server) and the Set-Cookie header (server to browser) look similar, but Set-Cookie has a pile of attributes: Expires, Path, Domain, Secure, HttpOnly, SameSite.
Here you can paste a header or build one from scratch. In Parse mode we break each cookie into attributes, show the expiry date ("in 3 days" / "EXPIRED") and assess security: missing Secure, missing HttpOnly, SameSite=None without Secure - you get a clear warning with description.
In Build mode you design a Set-Cookie step by step with a form: fields, dates, Apple-style switches. Secure defaults set Secure + HttpOnly + SameSite=Lax + Max-Age=24h with a single click.
How to use it
- Parse: paste a full `Set-Cookie:` header (or many lines) or a `Cookie:` header - we detect both. You get a table with attributes and a security assessment.
- Long values are truncated with a "Show more" link. The "Copy" button grabs the full cookie line.
- Colored pills show SameSite (red=None, green=Lax, blue=Strict), Priority (Low/Medium/High) and Partitioned (CHIPS).
- Build: enter a name and value, pick Max-Age or Expires (mutually exclusive), set Path, Domain, toggle Secure/HttpOnly/Partitioned, choose SameSite and Priority.
- The "Secure defaults" button drops in a configuration that any auditor would approve: Secure + HttpOnly + Lax + 24h lifetime.
- Copy the resulting `Set-Cookie:` and paste it into your backend response header or your cURL/HTTPie tests.
When this is useful
Real situations when working with sessions and security:
- Login debugging - "why does my session not stick?". Paste the Set-Cookie header from DevTools and check if it has Secure, the right domain, whether SameSite is blocking cross-site requests.
- Security audit - reviewing cookies of a legacy app, hunting for ones without HttpOnly (XSS exposed) or Secure (MITM exposed). You get the list of issues in a second.
- Writing new cookies - designing a login endpoint and wanting to "do it right". "Secure defaults" shows what a Set-Cookie should look like in 2026.
- cURL testing - copy a Set-Cookie header from browser DevTools, parse it, tweak, paste into a test script with `-H "Cookie: ..."`.
- SameSite=Lax migration - browsers keep getting stricter. Verify your cookies are aligned with the new standard.
- Cross-domain cookies - CHIPS / Partitioned cookies for embeds. Here you can see the flag is set correctly.
To inspect HTTP headers, use our HTTP headers inspector. For a headers reference, see HTTP headers reference. For HTTP status codes, use the status code reference.