Cookie and Set-Cookie Parser
Parse a Cookie header into its name and value pairs, or a Set-Cookie header into its attributes, with warnings for missing Secure, HttpOnly and SameSite.
Free · No sign-up · Your inputs stay in your browser
Input
Parse a Cookie or Set-Cookie header
Output
laravel_session
| Name | laravel_session |
|---|---|
| Value | eyJpdiI6IjZ2... |
| expires | Tue, 13 Oct 2026 20:00:00 GMT |
| max-age | 7200 |
| path | / |
| domain | .example.com |
| secure | set |
| httponly | set |
| samesite | lax |
Set-Cookie attributes follow RFC 6265 and its draft successor (6265bis). Max-Age wins over Expires when both are present; a cookie with neither is a session cookie that dies with the browser.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The attributes that matter
Secure keeps a cookie off plain HTTP. HttpOnly hides it from JavaScript, so an XSS bug cannot read a session token. SameSite=Lax stops it being sent on cross-site POSTs, a strong defence against CSRF; None is for cookies that must work cross-site and requires Secure. Laravel's config/session.php controls all three for the session cookie; set SESSION_SECURE_COOKIE=true in production.
Prefixes
A cookie named __Host- is only accepted if it is Secure, has Path=/ and no Domain, which pins it to one host so a subdomain cannot overwrite it. The rules are in the RFC 6265bis draft, which all major browsers implement.