Skip to content
TextArray1.41.0
100% local

Cookie parser

Break a Cookie or Set-Cookie header into individual cookies, values and attributes.

Input
Output
Related tools
HTTP header parserDeveloper tools
JWT decoderDeveloper tools
URL query parserDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
Cookie parser
Paste a browser Cookie header — the "name=value; name2=value2" line sent with every request — or a server Set-Cookie header, and this tool splits it into individual cookies you can actually read. In Cookie mode each entry becomes a clean name/value pair. In Set-Cookie mode it also pulls out every attribute: Domain, Path, Expires, Max-Age, Secure, HttpOnly and SameSite, one cookie per line the way browser devtools show them, since a Set-Cookie value can't safely be split on commas the way other headers can — the Expires date itself contains one.
Turn on URL-decode to reveal a percent-encoded value in its readable form — common when a cookie carries a JSON blob, a redirect URL or non-ASCII text. "Show expiry in readable form" adds a plain-language reading next to Expires or Max-Age, like "in 3 days" or "2 hours ago", computed from your device's clock and correctly phrased for your language. When both attributes are present, Max-Age wins, matching how browsers actually resolve it.
Turn on "Flag cookies missing Secure or HttpOnly" to highlight, right in the output, any cookie that skips one of those protections — a quick check when reviewing a response for a security review or a bug report. Choose whether the result comes back as an aligned table or as JSON, ready to paste into a script or a test fixture.
Everything runs locally in your browser: the header you paste, which can carry session tokens or other sensitive values, is never uploaded or logged anywhere. Copy the result, download it as a .txt file, or send it straight into another tool such as the JWT decoder to keep inspecting it.
FAQ
What is the difference between Cookie and Set-Cookie mode?
Cookie is the header a browser sends with a request — just name=value pairs, no attributes. Set-Cookie is what a server sends back, and can carry Domain, Path, Expires, Max-Age, Secure, HttpOnly and SameSite alongside the value.
Why does it expect one Set-Cookie header per line?
A Set-Cookie value can contain an Expires date with a comma in it, so multiple Set-Cookie headers can't be joined on commas the way other headers are. Pasting one per line — exactly how browser devtools display them — avoids that ambiguity.
How is the readable expiry calculated?
From Max-Age when it's present, otherwise from Expires, compared against your device's current time. A Max-Age of zero or less is shown as "now", matching how browsers treat it as a delete instruction rather than a countdown.
What does flagging a cookie as missing Secure or HttpOnly mean?
Secure means the cookie is only sent over HTTPS; HttpOnly means client-side JavaScript can't read it. A cookie missing either is highlighted so you can spot a configuration gap while reviewing a response.
Is the header I paste uploaded anywhere?
No. Parsing happens entirely in your browser — the header, including any session token or cookie value it carries, is never sent to a server.