Set-Cookie header parser
Helps you see why a cookie is not stored or not sent by showing each attribute the way a browser reads it.
Loading the tool…
Processing and privacy: The result is calculated inside your browser and your data is not sent to any server.
How to use it
- Enter set-cookie headers (one per line).
- The result appears straight away and updates as you edit.
- Copy the result, or copy a link that keeps the same values to share it.
How it is calculated
It follows the RFC 6265 algorithm: name and value come before the first ;, then attributes with case-insensitive names. A leading dot in Domain is dropped, Max-Age accepts integers only, Path is kept only when it starts with /, and a repeated attribute takes its last value.
Example
Result: JSON: [ { "name": "session_id", "value": "abc123", "maxAge": 3600, "domain": "example.com", "path": "/", "secure": true, "httpOnly": true, "sameSite": "Lax" }, { "name": "theme", "value": "dark", "expires": "Wed, 21 Oct 2026 07:28:00 GMT", "path": "/" } ]; Cookies: 2; Lines ignored: 0.
Set-Cookie: session_id=abc123; Path=/; Domain=.example.com; Max-Age=3600; Secure; HttpOnly; SameSite=Lax Set-Cookie: theme=dark; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/
[
{
"name": "session_id",
"value": "abc123",
"maxAge": 3600,
"domain": "example.com",
"path": "/",
"secure": true,
"httpOnly": true,
"sameSite": "Lax"
},
{
"name": "theme",
"value": "dark",
"expires": "Wed, 21 Oct 2026 07:28:00 GMT",
"path": "/"
}
]Limits and caveats
- Expires is shown as written, without converting it to a date.
- A line with no = before the first ; or with an empty name is ignored, as in RFC 6265.
Questions about this tool
Which applies when both Expires and Max-Age are set?
Max-Age takes priority in browsers; Expires is used only when Max-Age is absent.
Why was the dot removed from Domain?
RFC 6265 ignores a leading dot, so .example.com means example.com and all its subdomains.
Can I paste several headers?
Yes. Put each Set-Cookie header on its own line to get one entry per cookie.