Cookie Viewer
Analyze, decode, and format raw cookie strings into an interactive detailed list.
About HTTP Cookie Viewer & Header Parser
HTTP Cookies (defined in RFC 6265) are small pieces of stateful data sent by a server to a user's web browser and stored on the client. The browser sends these cookies back to the server with subsequent HTTP requests via the Cookie request header. They are fundamental for session authentication, shopping carts, user preferences, and analytics tracking.
Key Cookie Attributes & Security Flags
- Name & Value: The primary key-value pair containing session identifiers, tokens, or configuration strings.
- Domain & Path: Defines the scope of the cookie—which hosts, subdomains, and URL paths are authorized to receive the cookie.
- Expires & Max-Age: Specifies the lifetime of the cookie. Without these attributes, the cookie operates as a session cookie and is destroyed when the browser closes.
- Secure Flag: Restricts cookie transmission strictly over encrypted HTTPS connections, preventing man-in-the-middle packet sniffing.
- HttpOnly Flag: Blocks client-side JavaScript (e.g.
document.cookie) from accessing the cookie, offering robust protection against Cross-Site Scripting (XSS) session theft. - SameSite Attribute (Strict / Lax / None): Controls whether cookies are sent with cross-site requests, providing critical defense against Cross-Site Request Forgery (CSRF) attacks.
Frequently Asked Questions (FAQ)
Why can't JavaScript view all my browser cookies automatically?
Modern browsers enforce security isolation. Cookies with the HttpOnly attribute or from different domains are protected from JavaScript access. You can paste your raw cookie headers here for full decoding and inspection.
What is the maximum size allowed for an HTTP cookie?
Most modern browsers enforce a maximum cookie size limit of 4096 bytes (4 KB) per cookie, including the name, value, and attributes.