Cookie & Set-Cookie Parser
Inspect request cookies or response Set-Cookie fields while preserving duplicate names, raw attributes and security-prefix diagnostics.
Choose the correct grammar
Cookie is a request header containing name=value pairs separated by semicolons. Set-Cookie is a response header in which each cookie has its own attributes, such as Path, Domain, Expires, Max-Age, Secure, HttpOnly and SameSite. Choose the mode before pasting. A header-name prefix is optional.
Request cookies are returned as an ordered list so repeated names are not overwritten. Response cookies retain the original line and every attribute alongside parsed values. The browser may apply additional acceptance and storage rules that a text parser cannot reproduce without the original request context.
Encoding, combined fields and diagnostics
Percent decoding is optional and does not turn + into a space. Invalid percent encoding stays visible with a diagnostic. Cookie parsing does not URL-decode by definition, so leave the option off when you need exact values.
Put separate Set-Cookie fields on separate lines. Enable combined-line splitting only when a capture merged them: Expires dates contain commas, so a comma is not always a cookie boundary. Diagnostics flag duplicate attributes, problematic __Host-/__Secure- prefixes and SameSite=None without Secure. They are checks of the text, not a security audit. Input is limited to 200,000 characters and 1,000 cookies.
Reference
Questions & answers
Why not return one object keyed by cookie name?
Repeated names are possible, including cookies from different paths. An object would hide duplicates and could suggest a precedence rule that was not present in the pasted header.
Does this read my browser cookies?
No. It parses only pasted text and never calls document.cookie or sends those values to a server.
Is my input uploaded?
No. Parsing and generation run in your browser. Engines and datasets load from this site; the tool does not store input or send it to a processing API.