← Utilities

Set-Cookie Header Parser & Validator

Last updated:

Paste Set-Cookie headers to see how a browser reads each one — and which ones it silently drops, like SameSite=None without Secure or a misconfigured __Host- prefix. All in your browser, nothing uploaded.

How it works

  • Paste one Set-Cookie header per line (the Set-Cookie: prefix is optional). Each cookie is marked Accepted or Rejected, with its lifetime, attributes, and any issues.
  • The point is catching cookies a browser drops silently — the response looks fine and the server never hears about it, the cookie just never appears. That happens for SameSite=None without Secure, a __Secure- cookie without Secure, a __Host- cookie without Secure and Path=/ or with any Domain, Partitioned without Secure, and name + value over 4096 bytes.
  • Some attributes change what the cookie does without dropping it: when both are set, Max-Age wins over Expires; Max-Age=0 (or an Expires in the past) deletes it; an unparseable Expires/Max-Age, an unknown SameSite value, or a Path not starting with / is ignored rather than rejected; and with no SameSite at all, Chrome and Edge treat it as Lax.

What a header alone can’t tell you: whether Domain matches the site that sent it, whether a Secure cookie arrived over plain HTTP, or whether the browser blocks third-party cookies — those depend on the request URL and browser settings, not the header.

Runs entirely in your browser — nothing you paste here is uploaded, logged, or stored.

🔑 Also try: JWT Decoder →