Runs locally in your browser. Nothing you enter is uploaded to our servers.
Result will appear here
Tips for analyzing cookies
Look for Secure, HttpOnly, and SameSite flags on session cookies.
Overly broad Domain/Path increases exposure.
Long-lived cookies raise risk if stolen.
Paste only cookies you are allowed to inspect.
Treat cookie values as sensitive — clear them after review.
Parse cookie strings, do not steal sessions
Processing stays in your browser — your input is not uploaded to our servers.
Paste a `Cookie` or `Set-Cookie` header to see names, flags like HttpOnly/Secure, and expiry. The parser runs on the string you provide — it does not read other sites’ cookies.
Use it on headers you already captured in DevTools for an app you own.
Analyze a cookie header
Paste the header value
Include flags if you copied Set-Cookie. A bare name=value pair still parses.
Read flags and scope
Missing Secure on HTTPS apps and missing HttpOnly on session cookies are the usual findings.
Clear the paste
Session cookies are credentials. Do not leave them in a ticket screenshot.
Cookie analyzer FAQ
Does this list cookies for every site I visit?
No. It only parses the text you paste. There is no silent cookie jar access.
Can I decode a JWT sitting in a cookie?
Copy the value into the JWT decoder. This tool splits cookie syntax, not JWT claims.
Is the header uploaded?
No. Parsing is local.