Skip to content
yutils
Example

Input (Set-Cookie header)

session=abc123; Domain=yutils.dev; Path=/; Expires=Wed, 13 May 2026 12:00:00 GMT; Secure; HttpOnly; SameSite=Lax

Output

name: session
value: abc123
domain: yutils.dev
path: /
expires: Wed, 13 May 2026 12:00:00 GMT
secure: true
httpOnly: true
sameSite: Lax

Note

Recognizes both request `Cookie:` and response `Set-Cookie:` headers. URL-encoded values are auto-decoded.

Usage / FAQ

When to use

  • Security audit — confirm `Secure`, `HttpOnly`, `SameSite` attributes
  • Debug session cookies — is the value URL-encoded JSON?
  • Compare cookie policies across multiple sites
  • Split individual cookies from a request `Cookie:` header
  • Check expiration time and path scope

FAQ

Q.What do the SameSite values mean?
A.`Strict` = same-site only (no cookie on cross-site links). `Lax` = also allowed on top-level navigation (modern Chrome default). `None` allows all but requires `Secure`.
Q.HttpOnly vs Secure?
A.`HttpOnly` blocks JavaScript's `document.cookie` access — protects against XSS. `Secure` requires HTTPS — protects against eavesdropping. Both are near-mandatory.
Q.Why is the value often URL-encoded JSON?
A.RFC 6265 disallows certain characters in cookie values (spaces, semicolons, commas, …). Complex values like JSON are typically URL-encoded before storage.
Fun facts

  • HTTP cookies were invented in 1994 by Lou Montulli at Netscape. The original purpose was 'online shopping carts' — keeping per-user baskets without the server holding state. That simple idea became the foundation for sessions, authentication, ad tracking, and analytics.

    Wikipedia — HTTP cookie

  • The cookie spec has been revised multiple times — Netscape's informal 1994 spec → RFC 2109 (1997) → RFC 2965 (2000) → today's RFC 6265 (2011). RFC 6265 is the most practical of them: it dropped the complex features of the earlier RFCs and aligned with what browsers actually implement.

    RFC 6265 (2011)

  • The SameSite attribute (introduced in 2016) is core to CSRF defense — `Strict` / `Lax` / `None`. Chrome 80 (2020) changed the default from None to Lax, forcing explicit SameSite declarations, and a global wave of 'cookies suddenly stop working' compatibility incidents followed.

    web.dev — SameSite cookies

Related tools

See all in this category →