Cookie analysis/security diagnosis tool | Set-Cookie Checker
Disassemble Cookie/Set-Cookie headers to see attributes, scope, expiration time, and security considerations.
Cookies to analyze
Paste the Cookie/Set-Cookie copied from DevTools or HTTP log.
Parse with Ctrl/Command + Enter
Please enter your cookie string or open the sample.
Diagnosis result
Displays analysis results by severity.
- Cookie
- 0
- serious
- 0
- warning
- 0
- Caution
- 0
- No problem
- 0
There are no diagnostic results matching your criteria.
About this tool
Before sharing and deploying your web app's authentication and configuration cookies, you can check the Set-Cookie attribute and sending scope.
Features
- Parsing cookies, Set-Cookie, and entire HTTP headers
- Secure, HttpOnly, SameSite, Domain, Path, Expiry date
- Check requirements for __Secure-, __Host-, and Partitioned cookies
- Diagnosing same-name cookies, duplicate attributes, size, syntax, and estimated scope
How to use
- Paste the cookie string or open a text file.
- If necessary, enter the URL for setting cookies in the judgment criteria URL.
- Run the analysis and check the reasons and countermeasures for critical, warning, and caution statuses.
- Copy the modified example or save the diagnostic report with the values suppressed.
Limitations
- Due to browser restrictions, it is not possible to automatically obtain cookies or HttpOnly cookies from arbitrary sites.
- Cookie request headers do not include attributes, so check things like Secure and SameSite in the Set-Cookie header.
- Public suffixes, browser-specific limits, and application usage cannot be fully determined.
- Diagnosis results are supplementary information. We do not guarantee that there are no vulnerabilities or that all browsers will behave the same.
Privacy: Cookie strings, files, URLs, and diagnostic results are processed only within the browser and are not sent to or saved on the Develop Tools server.