🍪 Dev

HTTP Cookie Parser

Paste a Set-Cookie header and inspect name, value, Domain, Path, Expires, Max-Age, HttpOnly, Secure and SameSite separately. Browser-only.

Set-Cookie header(s)

Cookies analisados

Reading a Set-Cookie: value and attributes apart

A Set-Cookie looks like a list of semicolon-separated pairs, but it is not: only the first pair is the cookie. Everything after it is an attribute, and that asymmetry is where home-grown parsers go wrong. The page splits it correctly and accepts several lines at once, with or without the header name in front.

The attributes that change behaviour are Domain and Path, which set the scope; Expires and Max-Age, which set the lifetime; and Secure, HttpOnly and SameSite, which restrict who sends and who reads. Max-Age wins over Expires when both appear, and the absence of both makes the cookie last until the browser closes.

One detail that catches people out: the Domain attribute does not narrow, it widens. With no Domain, the cookie applies only to the exact host that set it; with Domain set to the parent domain, it applies to every subdomain. Writing your own domain there is the opposite of tightening scope — it opens it to any subdomain, including a compromised one.

Frequently asked questions

Can the cookie name contain any character?

No. It is an HTTP token, which rules out space, semicolon, comma, equals and control characters. The value is more permissive in practice, but anyone who wants safety encodes the value — because a semicolon there breaks attribute separation and can inject an attribute you never wrote.

Why is Path not a security boundary?

Because path separation is not isolated in the browser: a script on one page can reach a cookie from another path of the same origin by indirect routes. Path is for organising and cutting traffic, not for isolation. Real isolation comes from a distinct origin.

How many cookies, and how large?

The standard asks browsers to support at least 50 cookies per domain and 4096 bytes per cookie, counting name, value and attributes. Current browsers allow more, but going past 4 kB is asking for the cookie to be silently discarded — and a cookie that busts the limit raises no error at all.

Related Tools

📊

Range Header Parser

Decompose a Range header (bytes=0-499, bytes=-100, etc.) into individual ranges with start, end and size.

💾

Cache-Control Parser

Read a Cache-Control header and show each directive (max-age, no-cache, public, immutable, stale-while-revalidate) with explanation.

🔍

UUID Parser

Decompose a UUID into version (1, 3, 4, 5, 6, 7, 8), variant, and when applicable, timestamp and node. Supports UUIDs with or without dashes.

⏱️

Retry-After Header Parser (HTTP 429 and 503)

Paste a Retry-After value in delay seconds or HTTP-date form to get the wait in seconds and minutes, or the exact instant to try again.

🆔

URN Parser

Decompose a URN (urn:NID:NSS) into namespace identifier (NID) and namespace-specific string (NSS). Supports r-component and q-component (RFC 8141).

❄️

Snowflake ID Parser

Decompose a snowflake (Twitter, Discord) into timestamp, worker ID, datacenter ID and sequence. Shows the human-readable date.