Tool
What the Cookie Security Checker does
Cookie Security Checker: checks Result, Issues and Report from Set-Cookie header(s), one per line. Example: the sample loaded on the page gives result 3 issues across 3 cookies.
With Set-Cookie header(s), one per line entered, the Cookie Security Checker works out Result, Issues and Report. Adjust anything and the figures re-derive on the spot.
Most people who open the Cookie Security Checker are someone verifying a download. Reusing a password is still the single most common way accounts fall over.
Nothing leaves the tab. You can watch your browser network panel while you use it and see for yourself.
Field definitions, the method, and a worked example from the default values are all set out further down the page.
What do the Cookie Security Checker fields mean?
The Cookie Security Checker uses 1 input. A filled form means you can test one idea immediately instead of sourcing every input first.
| Field | What to enter | Default |
|---|---|---|
| Set-Cookie header(s), one per line | paste or type any amount of text | Set-Cookie: session=eyJhbGciOi...; Path=/; HttpOnly Set-Cookie: theme=dark; Path=/; Max-Age=31536000 Set-Cookie: __Host-csrf=9f8e7d; Path=/; Secure; HttpOnly; SameSite=Strict |
How does the Cookie Security Checker work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same check.
Bad input produces an error, never a confident-looking wrong answer.
Worked example
These are the values the Cookie Security Checker loads by default, and the result it produces from them. Below is the same computation the tool performs on load, step by step.
| Set-Cookie header(s), one per line | Set-Cookie: session=eyJhbGciOi...; Path=/; HttpOnly Set-C… |
|---|
| Result | 3 issues across 3 cookies |
|---|---|
| Issues | 3 |
| Report | session: no Secure (sent over plain HTTP); no SameSite (browsers default to Lax; say so explicitly); session cookie… |
How to use it
- Paste your content into Set-Cookie header(s), one per line.
- No submit step is needed; the output updates while you edit.
- Look at Result, Issues and Report in the output panel.
- Copy Link when you want to return to this exact configuration; Print when someone needs it on paper.
What this tool does not do
- Randomness comes from your browser's cryptographic random source, which is suitable for passwords and keys.
- Anything generated here is only as safe as where you store it afterwards.
- Where a standard has revisions, the version used is the one named in the method section.
Frequently asked questions
You need Set-Cookie header(s), one per line. Every box already holds a working value, so nothing is mandatory before you see a result.
With the values loaded when the page opens, result comes out as 3 issues across 3 cookies. Adjust any field to see how much the answer depends on it.
No record is kept. We never receive what you type, so there is nothing on our side to retain.
No charge. Everything on the page is available without signing in.
The computation is exact; how much you should trust the answer depends on how good your inputs are.