Set-Cookie Header Builder

About Cookie Parser and Builder

A cookie is a name, a value and a set of attributes that tell the browser when to send it back. Browsers enforce rules on those attributes, and when a cookie breaks one it is not set. No error is shown to the page. This tool reads a cookie, applies those rules, and explains any it breaks.

The rejections are the ones people lose hours to. SameSite=None without Secure. A __Host- cookie with a Domain or without Path=/. Partitioned without Secure. An Expires date browsers cannot read. Each is reported as a problem. The softer risks are reported too: a session cookie scripts can read, a Domain that shares the cookie with every subdomain, and a lifetime past the 400-day cap browsers now apply.

Paste Set-Cookie headers to read what a server sends, or a Cookie header to read what a browser sends back. You can also build a cookie from its settings and get it as the header or as the call for Express, Next.js, Flask, Django, Go, PHP or browser JavaScript.

Where it helps

• Applies the rules browsers enforce without telling you: prefixes, SameSite=None, Partitioned and unreadable dates.
• Explains the lifetime precisely: Max-Age wins over Expires, an expiry in the past deletes the cookie, and browsers cap lifetimes at 400 days.
• Flags session and auth cookies that scripts can read or that are sent over plain HTTP.
• Writes the same cookie for eight targets and notes where they differ, such as Express using milliseconds and HttpOnly cookies being unreachable from document.cookie.
• Runs in the browser and hides cookie values until you reveal them, since they are often live session credentials.

Limits

• It checks each cookie on its own. Whether a browser sends it on a given request also depends on the request's site, path and scheme, which a pasted header does not include.
• Browsers differ on some edge cases, such as the default when SameSite is not set, and on third-party cookies generally. The checks follow current Chromium and the RFC 6265bis draft.

Frequently asked questions

Why isn't my cookie being set?

The common causes are SameSite=None without Secure, a __Host- or __Secure- prefix whose rules are not met, Secure on a page served over plain HTTP, a Domain that does not match the site, or the response being cross-origin without credentials: include on the fetch. Paste the Set-Cookie header here to check the first three.

Which SameSite value should I use?

Lax for most cookies: the cookie is sent when someone follows a link to your site, but not on cross-site form posts or in iframes. Strict for cookies that authorise sensitive actions, if you accept that users arriving from a link will appear logged out on the first page. None only for cookies that must work inside another site, such as an embedded widget, and always with Secure.

What does the __Host- prefix do?

It makes the browser guarantee three things before accepting the cookie: it was set over HTTPS with Secure, it has no Domain, so it belongs to this exact host, and its Path is /. A subdomain or a plain-HTTP page cannot then overwrite it, which is why it is recommended for session cookies.

What is a Partitioned cookie?

Partitioned opts a third-party cookie into CHIPS: the browser stores a separate copy for each top-level site the cookie is used on. An embedded chat widget can then keep its state on each site without that state being used to track the user across sites. It requires Secure.

Related tools

• JWT — Read, verify and sign JSON Web Tokens
• CSP Generator — Build a Content-Security-Policy, or check one, and write it for your server or framework
• CORS Generator — Write CORS configuration for nginx, Express, Go, Django, ASP.NET, Spring and more, and test an origin against it
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• HTML Formatter — Indent and tidy HTML markup
• CSS Formatter — Format stylesheets with consistent indentation

More Web Development tools

• HTML Formatter — Indent and tidy HTML markup
• CSS Formatter — Format stylesheets with consistent indentation
• JavaScript Formatter — Re-indent JavaScript and TypeScript source
• SCSS/SASS Formatter — Format SCSS syntax and nested rules
• TypeScript Formatter — Format TypeScript source code
• SQL Formatter — Format SQL statements with dialect selection
• SQL Minifier — Collapse formatted SQL into compact text
• CSS Unit Converter — px, rem, em, percentages and viewport units, with a preview
• Query String Parser and Builder — Convert query strings into editable key-value data
• CSP Generator — Build a Content-Security-Policy, or check one, and write it for your server or framework
• CORS Generator — Write CORS configuration for nginx, Express, Go, Django, ASP.NET, Spring and more, and test an origin against it
• cURL Builder — Build an HTTP request and get it as curl, JavaScript, TypeScript, Go, Python, PHP, C#, Java and more
• Minifier — Shrink CSS, HTML or JavaScript
• Flexbox Playground — Try every flex property and read the CSS back
• CSS Grid Playground — Build a grid template and see the tracks it makes
• Responsive Viewport Tester — Render your markup at phone, tablet and desktop widths
• SVG Path Viewer — Draw path data and read back what it contains
• SVG to CSS Converter — Turn an SVG into a data URI for CSS or an img tag
• OAuth 2.0 / OIDC Helper — PKCE verifiers and challenges, state, nonce, and checking what came back
• Regex Tester — Test patterns, inspect groups and preview replacements
• User-Agent Parser — Identify the browser, engine, operating system and device behind a User-Agent string
• HTTP Status Codes — Look up what a status code means, when to send it, and whether it is cached or safe to retry
• HTML to JSX — Convert HTML and SVG markup into JSX for React, with styles, attributes and whitespace handled
• Semver Checker — Test versions against npm ranges, sort them by precedence, and see what each bump produces
• Cookie Parser and Builder — Read Set-Cookie and Cookie headers, check them against browser rules, and write one for your framework