Cookie Analyzer

Check cookies for Secure, HttpOnly and SameSite flags.

Each line is a Set-Cookie header

Set-Cookie headers (one per line)

What Is a Cookie Analyzer?

The Cookie Analyzer examines Set-Cookie headers and checks each cookie for the Secure, HttpOnly, and SameSite flags, and whether an expiry is set. It counts how many cookies use each security property and lists issues for cookies that are missing protection. This free online security tool is useful for cookie security checker, Set-Cookie analyzer, cookie analyzer. Common use cases include checking Secure, HttpOnly, SameSite, expiration, and other session-cookie security attributes. It is designed for quick browser-based analysis and development workflows. Security checks are signals rather than guarantees, so production systems should also be validated against current standards and their specific threat model.

How to Use This Cookie Analyzer

1
Provide the configurationPaste the relevant policy or response headers into the analyzer.
2
Run the analysisLet the tool inspect the supplied directives and values.
3
Review warningsIdentify settings that are missing, overly broad, unsafe, or inconsistent.
4
Compare with application needsA secure configuration must still allow the resources and cross-origin behavior your application requires.
5
Retest after changesUpdate the server configuration and run the analyzer again.

Frequently Asked Questions

HttpOnly prevents client-side scripts from reading the cookie, which helps stop cross-site scripting attacks from stealing session tokens.

SameSite controls when a cookie is sent with cross-site requests, offering protection against cross-site request forgery (CSRF). Strict and Lax are the safer values.

You paste the cookie headers to analyze them. The analysis runs locally in your browser and nothing is stored.

Related Security & Privacy Tools

Password Generator

Generate strong random passwords with full control.

Random Password Generator

Create secure random passwords instantly.

Password Strength Checker

Evaluate how strong a password really is.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512 and SHA-3 hashes.

JWT Decoder

Decode the header and payload of a JWT token.

JWT Inspector

Decode a JWT and check exp, nbf and algorithm claims.

More Security & Privacy Tools

SSL Certificate Checker

Read and analyze the TLS certificate a server presents.

SSL Expiry Checker

See how many days remain until a certificate expires.

Security Headers Checker

Verify the presence of essential security headers.

HTTP Headers Analyzer

Fetch and inspect every response header of a URL.

CSP Checker

Review a Content Security Policy for risky directives.

CORS Checker

Analyze CORS headers for misconfigurations.