Cookie String to JavaScript

Features

• Two outputs: document.cookie assignments, or an object literal
• Understands request-header cookies and response Set-Cookie lines, detected automatically
• Path / Expires / Secure / SameSite are carried through, or dropped entirely
• HttpOnly is omitted with the reason — it exists precisely to keep JavaScript out
• Domain is omitted with the reason — document.cookie only applies to the current origin
• A value containing a semicolon, comma or space is flagged by cookie name
• Quotes and backslashes in values are escaped, so the output is always valid JavaScript
• Comments are written in English — they are meant to go into a .js file
• Everything runs locally in the browser; cookies are never uploaded

How to use

1. Paste the cookie string (the `Cookie:` / `Set-Cookie:` prefix is optional)
2. Pick the output: assignment statements, or an object literal
3. Copy the code into your console or your script

FAQ

Why was the HttpOnly cookie left out?

Because it cannot be set. The entire purpose of `HttpOnly` is to make a cookie off-limits to JavaScript — the browser ignores a `document.cookie` assignment carrying it, without an error or any notice. So it is omitted here with a comment saying so, rather than emitting a statement that will never take effect and leaving you thinking it did. To set HttpOnly you need a `Set-Cookie` response header from a server.

Why is Domain omitted too?

Because `document.cookie` obeys the same-origin policy and can only write cookies for the page origin it runs on (and its subdomains). A `Domain=other.example` copied from elsewhere will do nothing on your page, and keeping it would only suggest otherwise. The rule: for `Domain` to take effect, run the code on a page under that domain.

I ran it in the console and the cookie was not set?

The usual cause is an illegal character in the value: cookie values allow only a specific ASCII set, and a semicolon, comma, space or quote makes the browser ignore the whole assignment silently (nothing appears in the console). The output names these cases in a comment; the fix is to URL-encode the value (`encodeURIComponent`) before setting it. Another cause is the page being inside an iframe or subject to third-party cookie restrictions.

Can I set a cookie for another domain?

No. `document.cookie` writes the current page cookie, and cross-origin writes are not possible — that is the same-origin policy, not a limit of this tool. To test a cookie, open the console on the site it belongs to. Note also that `Secure` requires an https page; an assignment carrying `Secure` on an http page is likewise ignored.

Are my cookies uploaded?

No. Parsing and generation happen entirely in browser memory; the page makes no requests and works offline. ⚠️ One warning though: cookies are often session credentials, so pasting one into any online tool hands it over — this tool does not upload anything, but the code you copy still contains it, so be careful where you share it.