日本語English

Cookie / Set-Cookie Studio

Paste a Cookie header or Set-Cookie lines to see each attribute (Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite, Partitioned) in a table, with points to check. The form also builds a Set-Cookie header and framework code.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Paste

Paste the Set-Cookie: lines as they are, one per line (several lines are fine).

Paste a cookie to see the list and the points to check here.

How to use

  1. Cookie header
    Set-Cookie header

    Paste a cookie

  2. Attribute table
    SameSite and Secure checksViolations are flagged

    Parse and check the rules

  3. Express, Next.js and more

    Generate server code

Paste a cookie, check its attributes in a table, and get server code

  1. In the Parse tab, choose the input type (Cookie header or Set-Cookie) and paste it. “Try a sample” also works.

  2. Paste each Set-Cookie on its own line. The table shows the name, expiry, Domain, Path, Secure, HttpOnly and SameSite.

  3. Go through “Points to check” from high to low. The findings are guidance, so compare them with your server’s actual settings.

  4. In the Generate tab, fill in the name, value and attributes. Fix any field that shows an error to see the Set-Cookie header and framework code.

  5. Before you copy the code, check that your library version supports it.

What it does

Attribute table and points to check

Each Set-Cookie is shown as one row with its name, value, expiry, Domain, Path, Secure, HttpOnly, SameSite, Partitioned and Priority. Parsing follows RFC 6265bis: Max-Age takes precedence over Expires, and an invalid Expires is ignored.

Hides values that look secret

Checks the shape of keys such as JWT, AWS, GitHub and Stripe with the same rules as the secret scanner. Matching values are hidden in the table, and findings show only the rule name.

Set-Cookie generator and five code formats

Builds a Set-Cookie header from a form, with code for Express, Next.js, PHP, Django and nginx (proxy_cookie_flags). The value can be URL-encoded, and a ; or line break in it cannot add an attribute or a new header.

Prefix and combination checks

Checks the __Host- and __Secure- rules, and that SameSite=None and Partitioned need Secure. A Domain with one or two labels is flagged as covering a wide range of hosts.

Use cases

  • Check that SameSite, Secure and HttpOnly are written correctly in a Set-Cookie
  • Find out why a SameSite=None cookie is not stored
  • Check the rules for the __Host- and __Secure- name prefixes
  • See how to set a cookie in Express, Next.js, PHP and other frameworks
  • Understand the attributes you see in the browser developer tools

Supported formats

Input

Cookie header (name=value; name2=value2)Set-Cookie header (one per line, several lines allowed)

Output

Set-Cookie headerCode for Express, Next.js, PHP, Django and nginx

Capability matrix

FeatureSupportNotes
Parsing Cookie and Set-Cookie headers into an attribute tableSupported—
Points to check (SameSite, Secure, prefixes, Domain, expiry and more)PartialGuidance based on the specification. Browser differences are not included
Detection of values that look secretPartialOnly shapes that match the rules. Secrets in other shapes are not found
Generating a Set-Cookie header and code for languages and frameworksSupported—
Fetching the real cookies from a siteNot supportedEntering a URL does not connect to it. Paste the response headers instead
Reading cookies stored in the browserNot supportedNot possible from here. Use the Cookies view in developer tools (Application in Chrome, Storage in Firefox)
Testing cookie sending and receiving in a browserNot supportedOnly the format and the specification are checked. Actual exchanges are not tested

Limits & notes

  • The checks are guidance based on RFC 6265bis and the behaviour of major browsers. Results can differ by browser and version.
  • Values that look secret use the same rules as the secret scanner, without the entropy check. Random session IDs may therefore not be flagged.
  • Up to 200 lines and 50,000 characters can be parsed at once.
  • The generator accepts Max-Age up to 31536000 seconds (one year). The name and value together must be 4096 bytes or less.
  • Path is checked for its shape only. Domain is checked for its shape and against a short list of representative public suffixes (such as co.jp and github.io). A public suffix that is not on that list is not detected.
  • The code examples show common syntax. Argument names and defaults can differ between library versions.
  • Works on phones too, but PC is recommended for checking many cookies at once.

Privacy & safety

The cookies you paste are processed only in your browser. Nothing is sent to or stored on a server.

FAQ

Why is a SameSite=None cookie without Secure not stored?
SameSite=None allows the cookie to be sent from other sites. Major browsers refuse to store a SameSite=None cookie that is not Secure (sent over HTTPS only). Add Secure.
What does HttpOnly do?
It hides the cookie from JavaScript (document.cookie). It reduces the risk of the cookie being stolen through XSS, but it does not prevent XSS itself.
Which takes precedence, Max-Age or Expires?
Max-Age takes precedence. With neither, the cookie is a session cookie and is removed when the browser closes.
What is the difference between __Host- and __Secure-?
__Host- requires Secure, Path=/ and no Domain, and it is tied to the host that set it. __Secure- requires only Secure. Both are name prefixes, and browsers refuse to store the cookie if its conditions are not met.
Should a cookie value be URL-encoded?
If the value contains ;, a comma, a space or a line break, the Set-Cookie line breaks, so encode it. The program that reads the cookie must decode it. The “URL-encode the value” option here produces the encoded form.

CSP Studio

Paste a Content-Security-Policy header or meta tag to see unsafe-inline, unsafe-eval, wildcards and missing object-src or base-uri, ranked high, medium or low, with a suggested policy. Generation and hash calculation are included.

No upload

Secret Scanner

Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.

No upload

HAR Sanitizer

Load a HAR saved from your browser developer tools and save a copy with cookies, auth headers, URL tokens, passwords and JWTs redacted, before you send it to support. A helper only — it cannot guarantee that every secret is found. The HAR never leaves your device.

No upload

curl Converter

Paste “Copy as cURL” from Chrome or Firefox to see the method, URL, headers, cookies and body in tables, then convert to 12 kinds of code. The request is never sent and everything runs in your browser. Authorization and cookies can be hidden before you share.

No upload

Mail Header Analyzer

Paste Gmail’s “Show original” or the headers of an .eml file to get the delivery route in time order, authentication results and mismatches with the From domain. Everything runs in your browser; no DNS, WHOIS or IP location lookups are made.

No upload

HTML Inspector

Paste a page’s HTML to review SEO and accessibility basics at a glance: heading structure, meta tags, Open Graph, image alt text, links and structured data — with a preview of how it may look in search and on social media.

No upload

Last updated: