Dev

Cookie Header Decoder

Paste a Set-Cookie header, a Cookie header or the whole response — every cookie decoded, every attribute explained, every browser rejection flagged before it bites.

Paste a Set-Cookie or Cookie header
Headers —
or drop a file here
Cookies —
Decoded cookies, attributes and warnings appear here
Settings Same-site request · https page · decode values
How It Works

How to Use Cookie Header Decoder in 3 Steps

1

Paste headers

Copy the response headers from DevTools → Network → Headers (or curl -I) and paste them. Set-Cookie: and Cookie: lines are picked out automatically; bare lines are treated as a Set-Cookie when they carry attributes, otherwise as a document.cookie string.

2

Read each cookie

Every cookie gets a card: name, raw value, the decoded value when it is URL-encoded, Base64 or a JWT, size, and each attribute as a chip — Domain, Path, when it expires (and how long from now), Secure, HttpOnly, SameSite, Partitioned, Priority. Warnings explain exactly what a browser will do with the cookie and why.

3

Fix and export

Change Judge for in settings to see how the same cookies behave in a cross-site (embedded) request. Copy the Markdown report or download JSON / CSV for a ticket.

FAQ

Cookie Header Decoder — Frequently Asked Questions

Which rules does it check?

The ones browsers actually enforce (RFC 6265bis, Chrome / Firefox / Safari behaviour as of 2026): SameSite=None requires Secure; __Host- needs Secure, Path=/ and no Domain; __Secure- needs Secure; name + value over 4096 bytes is dropped; expiry beyond 400 days is clamped by Chrome; invalid characters in names or values; Partitioned without Secure; a Domain with a scheme or port; a past expiry (which deletes the cookie); missing HttpOnly on session-looking cookies; duplicate names; and whether the cookie is even sent in a cross-site context.

How are values decoded?

If the value is percent-encoded it is URL-decoded. If it looks like a JWT (three Base64url parts whose header is JSON with an alg) the header and payload are shown as JSON, with exp / iat turned into dates. Otherwise, if it is valid Base64 and decodes to readable text or JSON, that is shown. Signatures are not verified here — use the JWT Builder & Verifier for that.

What is the difference between Expires and Max-Age?

Max-Age is a number of seconds from now and wins when both are present; Expires is an absolute HTTP date. Neither means a session cookie — deleted when the browser closes (Chrome may restore it with “continue where you left off”). A value of Max-Age=0 or an Expires in the past is how servers delete a cookie.

What does Partitioned mean?

CHIPS (Cookies Having Independent Partitioned State): a third-party cookie that is stored per top-level site, so the embed on site A cannot see what it set on site B. Chrome requires Secure and expects SameSite=None with it; it is the supported way for embedded widgets to keep state now that unpartitioned third-party cookies are being phased out.

Can I paste a HAR file?

Yes — open a .har export with the file button; every set-cookie response header and cookie request header in it is extracted, labelled with its URL.

Is my code uploaded anywhere?

No. Formatting and minifying run in JavaScript inside your browser tab. The formatter libraries are downloaded once from a CDN; your code never leaves the page.