Quick

Cookie String Builder & Parser

Build a correctly-formatted cookie string from fields, or paste a raw cookie string and parse it into a readable table.

HttpOnly only appears in the Set-Cookie header, because JavaScript in the page can't set it — hiding the cookie from page scripts is the whole point of the flag.

Advertisement

About this tool

Build assembles a cookie in the form both the document.cookie setter and the HTTP Set-Cookie header expect. The value is URL-encoded so spaces, semicolons and other special characters survive, and an expiry date you pick is converted to the GMT format browsers require. The tool also applies the browser rules for you: SameSite=None needs Secure, names starting __Secure- need Secure, and __Host- cookies need Secure, Path=/ and no Domain. Anything that would be rejected is flagged.

Parse reads a Cookie request header (several name=value pairs) or a Set-Cookie response header (one cookie followed by its attributes, which are listed separately). Percent-encoded and quoted values are decoded, with the raw value shown underneath so you can compare.