Productivity and Utilities

Set-Cookie Header Parser

Paste cookie header lines to see every attribute and a list of problems and notes.

SumPandasumpanda.com

Calculator report

https://sumpanda.com/set-cookie-header-parser/ ·

Your numbers

Result

Cookies read

1 problem found.

Problems: 1
Notes: 4
Largest name and value: 15 bytes

Each cookie

#	Name	Value	Settings
1	session	abc123	Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age 3600 seconds (1 hour)
2	theme	dark	SameSite=None; Domain=example.com; Expires 2026-10-21 07:28 UTC
3	__Host-token	xyz	Secure; HttpOnly; SameSite=Strict; Path=/; Session cookie
4	session	abc123	Sent by the browser
5	theme	dark	Sent by the browser
6	theme	light	Sent by the browser

Problems and notes

Cookie	Level	What it means
2	Note	A leading dot on Domain is ignored by current browsers.
2	Problem	SameSite=None needs the Secure attribute. Current browsers reject the cookie without it.
2	Note	No Secure attribute, so the cookie can also travel over plain HTTP.
2	Note	No HttpOnly attribute, so scripts on the page can read the cookie.
6	Note	The same cookie name is sent more than once. Servers usually use the first or the last one.

How this was calculated

A Set-Cookie line is split at the first semicolon. What comes before it is the name and value, split at the first equals sign. Each later piece is an attribute such as Path or Secure, matched without regard to capital letters.
Max-Age wins over Expires when both are present. A Max-Age of zero or less, or an Expires date in the past, deletes the cookie.
The problem checks follow RFC 6265 and the cookie prefix rules: SameSite=None needs Secure, __Host- needs Secure, Path=/ and no Domain, __Secure- needs Secure, and names and values must use allowed characters.
Notes point out missing protections (Secure, HttpOnly, SameSite). They describe what is absent, and whether it matters depends on what the cookie is for.

Real browsers add rules of their own, such as size limits, limits on how many cookies a site may set and blocking third-party cookies, and these change over time. This page reads only the text you paste and sends nothing anywhere.

Next step

Cache-Control Header ExplainerRead the caching rules in the same response.
CORS Preflight CheckerCheck whether the browser lets a script read the response.
HTTP Status Codes ReferenceLook up the meaning of the status that came with the headers.

How to use the set-cookie header parser

Paste the header lines, one per line. Start each with Set-Cookie: for a response header or Cookie: for a request header. A line with no prefix is read as a Set-Cookie value.
Enter the date the response arrived, in UTC, if you want Max-Age turned into an expiry date and past dates flagged. You can leave it blank.
Read the table of cookies for the name, value and settings of each one.
Read the second table for problems and notes, each tied to the number of the cookie it belongs to.

Formula

name-value pair = text before the first semicolon, split at the first equals sign

attributes = each later piece, name matched without regard to capital letters

Max-Age wins over Expires when both are set

expiry from Max-Age = date received + Max-Age seconds

This follows RFC 6265. A Max-Age of zero or less, or an Expires date in the past, tells the browser to delete the cookie at once.

Four sample headers

The first header sets a session cookie with Secure, HttpOnly, SameSite=Lax, Path=/ and a Max-Age of 3,600 seconds, which is 1 hour. It has no problems. The second sets a theme cookie with SameSite=None but no Secure attribute, which current browsers reject, so it is reported as a problem. Its Domain=.example.com has a leading dot, which browsers ignore.

The third, __Host-token, passes the strict rules for its prefix: Secure, Path=/ and no Domain. The fourth line is a Cookie request header with session, theme and theme again, and the repeated name is noted. In total six cookies are read, with one problem and four notes.

What counts as a problem

Problems are things that make a browser reject or cut short a cookie, or that make the header malformed: SameSite=None without Secure, a __Host- or __Secure- cookie that breaks its prefix rules, a name or value with characters RFC 6265 does not allow, a Max-Age that is not a number, a date browsers cannot read and a cookie bigger than about 4,096 bytes.

Notes are observations that may or may not matter: no Secure attribute, no HttpOnly attribute, no SameSite attribute, a Domain with a leading dot, both Max-Age and Expires, or a cookie that deletes itself. Whether a missing attribute matters depends on what the cookie is for.

Reading attributes

Secure keeps the cookie off plain HTTP. HttpOnly hides it from scripts on the page. SameSite controls whether it is sent on requests started from other sites. Domain widens the cookie to subdomains, and Path limits which parts of a site receive it. A cookie with no Max-Age or Expires lasts only for the browser session.

To read the caching rules that come in the same response, use the HTTP Cache-Control Explainer. To look up a status code, see the HTTP Status Codes page, and for a token that carries claims, the JWT Decoder.

Assumptions and limits

Only the text you paste is read. Nothing is sent or checked against a live site.
Dates are read in three common shapes and treated as UTC. Two-digit years of 70 to 99 mean 1970 to 1999 and 00 to 69 mean 2000 to 2069.
The size check counts the bytes of the name and value in UTF-8.
Real browsers add rules of their own, such as limits on cookies per site and blocking of third-party cookies, and these change over time.
Up to 100 lines are accepted, and nothing typed here leaves your browser.

Formulas reviewed October 10, 2026. See the calculation methodology for how SumPanda rounds, tests and sources its formulas.

Frequently asked questions

Why is SameSite=None a problem without Secure?

Current browsers require the Secure attribute on cookies that ask to be sent in cross-site requests with SameSite=None. Without it they reject the cookie, so it never gets stored.

What happens when both Max-Age and Expires are set?

Max-Age takes priority and Expires is ignored. Setting both is allowed and is sometimes done for older clients, but the page notes it because only one of them has an effect.

What does the __Host- prefix require?

The cookie must have the Secure attribute, Path=/ and no Domain attribute. If any of those is missing, browsers that support prefixes reject the cookie.

Why does the page not know the expiry date of a Max-Age cookie?

Max-Age counts seconds from the moment the browser receives the response. Without a received date, the page shows the length. Enter the date to see an expiry date.