Cookie Parser

What does this tool parse?

Paste in any of these and the Cookie Parser breaks it down into a clean table:

• A Cookie: request header or a raw document.cookie string — the simple name=value; name2=value2 format a browser sends on every request.
• One or more Set-Cookie: response headers — the format a server sends back, which adds attributes like Domain, Path, Expires, Max-Age, Secure, HttpOnly and SameSite.

The format is auto-detected per line: a line starting with Set-Cookie:, or containing attribute keywords like Domain=, Secure or SameSite=, is parsed as a response header; everything else is treated as plain name=value pairs. Values that look percent-encoded (cookies written with encodeURIComponent, common for JSON payloads packed into a single cookie) are automatically URL-decoded, so you see the readable value instead of %7B%22...%7D.

Why this is useful

Cookies carry most sites' authentication and session state, but the raw header text is hard to read at a glance — a long Cookie: line from DevTools or a curl -v dump is just semicolons and equals signs. A table makes it much faster to:

• Spot which cookie holds the session ID, auth token or CSRF token when debugging a login or session bug.
• Check whether a Set-Cookie response actually sets Secure, HttpOnly and SameSite as expected, before shipping a change to cookie security settings.
• Confirm a cookie's Domain/Path scope and expiration when it isn't showing up on a request you expected it on.
• Decode an encoded value without opening the browser console.

How to use it

1. Copy a cookie string from your browser's DevTools (Application → Cookies, or the Cookie/Set-Cookie header in the Network tab), or run document.cookie in the console and paste the result.
2. Paste it into the input box — the table updates as you type.
3. Read off each cookie's Name, Value, and (for Set-Cookie input) its Attributes column, which lists Domain, Path, Expires, Max-Age, Secure, HttpOnly and SameSite as they appeared.
4. Use the table's copy/download button to export the parsed rows as CSV.

FAQ

Can I paste multiple Set-Cookie headers at once? Yes — put each on its own line and every one is parsed into its own row.

What if my input doesn't match either format? Lines that can't be split into a name=value pair are skipped rather than causing an error; you'll just see fewer rows than lines pasted in.

Does it decode Base64 or JWTs inside a cookie value? No — only percent-encoding is decoded. For a JWT stored in a cookie, decode it separately with a JWT decoder tool.

Privacy

Parsing happens entirely in your browser — the cookie string you paste is never sent to any server. That matters here more than most tools: cookie values often include live session tokens or auth secrets, so treat pasted values as sensitive and avoid sharing screenshots of the output. Sharing a link to this tool never includes your pasted cookie content.