Can I paste multiple cookies at once?

Yes, put one Set-Cookie header per line.

Why is SameSite=None flagged without Secure?

Modern browsers reject SameSite=None cookies that aren't also marked Secure.

Is this a live cookie scanner for my site?

No, paste headers you've already captured (e.g. via browser dev tools or curl -I).

Is my data uploaded to a server?

No. This tool runs entirely in your browser using standard web APIs, so your input never leaves your device and nothing is logged or stored on our servers.

Does it work offline and on mobile?

Yes. Once the page has loaded it keeps working without a network connection, and the layout is responsive so it stays usable on phones and tablets.

Cookie Attribute Analyzer

Parse Set-Cookie headers and flag security issues.

Support

Works Offline

Privacy First

No Login

No API

Set-Cookie header(s)

One cookie per line, with or without the 'Set-Cookie:' prefix.

Parsed cookies & issues

session= abc123

Domain: (host-only)

Path: /

Secure: true

HttpOnly: true

SameSite: Lax

No issues found.

tracking= xyz

Domain: .example.com

Path: /

Max-Age: 63072000s

Secure: false

HttpOnly: false

SameSite: (default)

high
Missing Secure — cookie can be sent over plain HTTP.
medium
Missing HttpOnly — cookie is readable by JavaScript, risking theft via XSS.
low
No SameSite attribute — defaults vary by browser; set it explicitly.
low
Very long Max-Age (>400 days) — consider shorter-lived sessions.

About the Cookie Attribute Analyzer

Paste one or more Set-Cookie headers to see each cookie's name, value, Domain, Path, Expires, Max-Age, Secure, HttpOnly, SameSite, and Partitioned attributes, with severity-tagged warnings for common security issues.

Examples

Insecure cookie

Set-Cookie: session=abc; SameSite=None

Output

High severity: SameSite=None without Secure

Keyboard shortcuts

Copy the main outputCtrl / ⌘ + Shift + C
Download the resultCtrl / ⌘ + S
Share this toolCtrl / ⌘ + Shift + S
Reset the inputsAlt + R
Open the tool search paletteCtrl / ⌘ + K

Related tools

Bulk URL Status Checker

Network & IP

Check HTTP status codes and redirects for many URLs at once.

HTTP Cache Header Planner

Network & IP

Plan Cache-Control, ETag and max-age headers for any asset type.

HTTP Header Comparator

Network & IP

Diff two sets of HTTP headers, case-insensitively.

HTTP Headers Explainer

Network & IP

Look up common HTTP headers and explain pasted raw headers.

HTTP Status Codes

Network & IP

Searchable reference of HTTP status codes with meaning and usage guidance.

HTTP/2 & TLS Version Test

Network & IP

See which TLS versions a site accepts and whether it serves HTTP/2.

Frequently asked questions

Version 1.0.0 · Updated 2026-08-10 · Runs entirely in your browser