Set-Cookie Parser

How to use

1. Copy the Set-Cookie headers from your browser's network panel or a curl -i response.
2. Paste them, one per line.
3. Read the attributes, then the warnings underneath each cookie.
4. Fix the warnings on anything carrying a session.

Features

• Every attribute read: Domain, Path, Expires, Max-Age, Secure, HttpOnly, SameSite.
• Missing Secure, HttpOnly and SameSite flagged.
• SameSite=None without Secure called out — browsers reject that cookie entirely.
• Already-expired cookies identified as deletions rather than settings.
• Runs entirely in your browser.

Frequently asked questions

Why is my cookie not being set?

The three usual causes are all visible here. `SameSite=None` without `Secure` is rejected outright. A `Domain` the response is not authorised for is ignored. And an `Expires` date in the past is not a cookie at all — it is an instruction to delete one, which is how a cookie appears to vanish the moment it is set.

Which attributes actually matter?

For anything carrying a session: `HttpOnly` so scripts cannot read it, `Secure` so it never travels in clear, and an explicit `SameSite` so behaviour does not depend on which browser the visitor uses. `Path` and `Domain` control scope, and widening them is how a cookie leaks to a subdomain you did not intend.

Why does my long expiry get shortened?

Browsers cap cookie lifetimes — around 400 days for `Expires` and `Max-Age` in current Chrome and Safari, and shorter still for cookies set by script on some platforms. Anything beyond that is flagged here, because the cookie you get is not the cookie you asked for.

Related tools