Cookie Inspector – Parse Set-Cookie Headers

Cookie Inspector — Parse Cookie & Set-Cookie Headers

Paste a raw Cookie request header or one or more Set-Cookie response headers and instantly see every cookie broken out in a clean, sortable table — name, value, Domain, Path, Expires or Max-Age, Secure, HttpOnly, SameSite and byte size. URL-encoded values are decoded automatically, and JWT tokens are expanded into readable header and payload JSON. Everything runs in your browser, so cookie values are never uploaded or executed.

Cookie or Set-Cookie header

Paste a Cookie: request header (name=value; name2=value2) or one or more Set-Cookie: response headers, one per line.

Header format

Leave on Auto-detect unless the format is guessed wrong.

Decode values

Show URL-decoded values and decode JWT tokens (header + payload) as read-only JSON.

Try an example

Everything runs in your browser — cookie values are never uploaded or executed.

Your parsed cookies appear here

Paste a Cookie or Set-Cookie header on the left to break it into a clear table.

	Value

	Value		Path	Expires / Max-Age	Flags

How to use

Copy a Cookie: header from your browser DevTools request, or Set-Cookie: header(s) from the response.
Paste it into the box on the left — the format is detected automatically.
Read the parsed table: sort by name or size, and check the flag badges for each cookie.
Expand any JWT value to view its decoded header and payload.
Copy the summary or export the whole table to CSV.

Features

Auto-detects Cookie request headers vs. Set-Cookie response headers
Full attribute breakdown: Domain, Path, Expires/Max-Age, Secure, HttpOnly, SameSite, Partitioned
Human-readable expiry dates with relative time, plus Session and Expired flags
Decodes URL-encoded values and expands JWT tokens to header + payload JSON
Per-cookie byte size and warnings for risky combinations like SameSite=None without Secure
100% client-side with CSV export — nothing is sent to a server

Frequently asked questions

What is the difference between a Cookie and a Set-Cookie header?

A Cookie header is sent by the browser in a request and lists just name=value pairs separated by semicolons. A Set-Cookie header is sent by the server in a response and defines one cookie with attributes like Domain, Path, Expires, Secure and HttpOnly. This tool detects which one you pasted and shows the right columns.

Does the tool send my cookies anywhere?

No. All parsing, decoding and JWT expansion happen locally in your browser with JavaScript. Cookie values are treated as text and are never uploaded, logged or executed.

How does it decode JWT cookie values?

If a value has three base64url parts separated by dots and the first two decode to JSON, it is shown as a JWT. The header and payload are pretty-printed as read-only JSON so you can inspect claims such as exp and iat. The signature is never verified or trusted.

How is the cookie size calculated?

Size is the UTF-8 byte length of the name=value pair, which is what counts toward the roughly 4096-byte per-cookie limit browsers enforce. Attributes like Path and Domain are not counted in that figure.

Why does it warn about SameSite=None?

Modern browsers reject a cookie set with SameSite=None unless it also has the Secure attribute. The inspector flags that combination so you can fix it before it silently fails in production.

Cookie Inspector — Parse Cookie & Set-Cookie Headers

How to use

Features

Frequently asked questions

Related tools