Cookie Analyzer
Check Set-Cookie headers for Secure, HttpOnly, SameSite and prefix issues
Input
Results
Details
What is Cookie Analyzer?
Cookie Analyzer parses Set-Cookie response headers and Cookie request headers and reviews every cookie attribute: Secure, HttpOnly, SameSite, Partitioned, Domain, Path, Expires, Max-Age, Priority, the __Host- and __Secure- name prefixes and the cookie size. Each cookie gets purpose-aware findings rated High, Medium, Low or Info, a list of passed checks and a heuristic score, so you can spot weak session cookies before they ship.
How to use
- 1.Choose Set-Cookie for response headers or Cookie header for a request header.
- 2.Paste one Set-Cookie per line, a full response header dump or a Cookie header, or load an example.
- 3.Optionally enter the site URL and pick the cookie purpose; Auto guesses it from each name.
- 4.Review the score, findings and passed checks, open a cookie for its attribute table, and copy the full or redacted header.
What the checks cover
The parser follows the RFC 6265bis rules browsers use: the name ends at the first "=", values may contain "=", attribute names are case-insensitive, the last duplicate attribute wins, Expires dates may contain commas, and Max-Age takes precedence over Expires. Checks flag missing Secure or HttpOnly, SameSite=None without Secure, invalid SameSite values, Partitioned without Secure, broken prefix rules, broad or mismatched Domain values, lifetimes above the 400-day browser cap, cookies larger than 4096 bytes and headers merged with commas. Severity depends on the purpose: missing HttpOnly is High for a session cookie but only Info for a theme cookie that scripts must read.
Privacy and limitations
Everything runs in your browser. Cookie values are masked by default, never stored, never added to the URL and never sent to analytics; reveal them or copy the full header only when you need to. The score is a heuristic, not a security guarantee, and privacy notes are prompts to review your own requirements, not legal conclusions. Public suffix rules beyond single-label domains, browser-specific defaults and server-side session handling are not evaluated, and a Cookie request header carries no attributes, so its checks are limited.
