Cookie Formatter
WebEverything runs locally in your browser — nothing is uploaded
⚠️ This tool makes no network requests, so the cookies are yours to fetch, from Application → Cookies in your developer tools or the Set-Cookie lines of `curl -I`. ⚠️ One more thing: never paste cookies that carry a live session into any online tool, since that hands over the session. This one runs entirely locally, but the habit is worth keeping. Break a `Cookie` or `Set-Cookie` line into a readable table — copy it out of your browser devtools and paste it in. ⚠️ These two headers look alike and mean entirely different things. The `Cookie` request header is a flat list of name-value pairs: ``` a=1; b=2; session=abc ``` That is three cookies. A `Set-Cookie` response header describes exactly one cookie per line, with its attributes after the semicolons: ``` session=abc; Path=/; HttpOnly; Secure ``` The same `a=1; b=2` here means "a cookie named a, with an attribute called b". Getting this wrong produces completely different output, and neither mistake throws — so this tool detects it automatically, and you can override the guess. The detection rule is "does any known cookie attribute name appear (Path / Domain / Expires / Max-Age / Secure / HttpOnly / SameSite)", not "is there anything after the first semicolon" — the latter would read the extremely common request header `a=1; b=2` as Set-Cookie. Along the way, percent-escapes like `%20` are decoded, and each cookie is checked for the security attributes it lacks: no `HttpOnly` means scripts on the page can read it (one XSS and the session is gone), no `Secure` means it also goes out over plain HTTP, and no `SameSite` means cross-site requests carry it along (the raw material of CSRF).
Features
- Parses both the `Cookie` request header and the `Set-Cookie` response header, with auto-detection and manual override
- `Set-Cookie` attributes become a side note — they never leak into the "value" you copy
- `Expires` and `Max-Age` become concrete times, with expired ones called out
- Flags which of `HttpOnly` / `Secure` / `SameSite` each cookie is missing
- ⚠️ Understands `Partitioned` (CHIPS) — and warns separately when `Secure` is missing, because that combination is rejected outright by the browser, unlike the “works but weaker” of a missing HttpOnly
- Optionally decodes percent-escapes in values
- Semicolons inside a quoted value are not treated as separators
- Parsed entirely on your device — cookies never leave it
How to use
- Paste the `Cookie` or `Set-Cookie` line into the left pane (multiple lines are fine)
- Override the parse mode if the guess is wrong for your case
- Results appear immediately; every row copies on its own
FAQ
- Why was my `a=1; b=2` parsed as two cookies?
- Because in a `Cookie` request header it genuinely is two cookies — that header separates multiple independent name-value pairs with semicolons, and that is its most common shape. Only in a `Set-Cookie` response header does anything after a semicolon mean an attribute. The two are told apart by "does a known attribute name appear": `a=1; b=2` contains none of `Path`, `HttpOnly` and friends, so it is read as a request header. Add an attribute and that changes — `a=1; b=2; Secure` parses as one cookie named `a` with `b=2` as an attribute of it. If the automatic guess does not suit your case, set the parse mode by hand.
- How much does the "no HttpOnly" warning matter?
- For a session cookie, a great deal. `HttpOnly` makes the cookie invisible to JavaScript — as soon as a page has an XSS (even just a poisoned third-party script), a cookie without `HttpOnly` can be read straight out of `document.cookie` and shipped to an attacker, and a stolen session is a stolen account. `Secure` and `SameSite` matter too, in different situations: `Secure` stops plaintext transmission from being intercepted, `SameSite` stops cross-site requests from carrying the cookie automatically (that is CSRF). Setting all three is almost always the right call.
- What is the difference between `Max-Age` and `Expires`?
- `Max-Age` is "this many seconds from now"; `Expires` is an absolute point in time. When both are present, `Max-Age` wins (per RFC 6265) — absolute times suffer from skewed client clocks and wrong timezone settings, relative seconds do not. Two other cases worth knowing: a value of zero or negative means delete this cookie now (that is how logout works), and setting neither makes it a session cookie that disappears when the browser closes — which is why some sites make you log in again every time.
Related tools
HTTP Header Formatter
WebTurn captured or curl-pasted HTTP headers into a table, convert byte sizes and charsets, and see which security headers a response is missing.
HTTP Status Codes
WebLook up an HTTP status code for its meaning, 1xx–5xx class, typical uses and common traps. Runs entirely in your browser.
Base64
EncodingConvert text to Base64 and back, with correct UTF-8 handling for accents, CJK and emoji. Runs entirely in your browser — nothing is uploaded.
URL Encode
EncodingEscape text into %XX form and back again, treating a whole URL and a single parameter value as different jobs. Runs entirely in your browser.
URL Parser
WebParse a URL into scheme, host, port, path, query parameters and fragment, with each parameter shown raw and decoded. Runs entirely in your browser.
User-Agent Parser
WebParse a user agent into browser, version, OS, device type and engine, and see which rules matched. Pattern matching only. Runs entirely in your browser.