Web Security

Cookie Security Analyzer

Audits Set-Cookie headers for the flags and prefixes that decide whether a cookie can be stolen or over-shared.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste one or more Set-Cookie headers, one per line. The "Set-Cookie:" prefix is optional.
  2. Select Analyze cookies.
  3. Read the Advice column for each cookie. A blank note means nothing was flagged in the attributes shown.
  4. Fix the flags at the source - this reads the header as pasted and cannot change what your server sends.

What cookie security analyzer does

A session cookie is only as safe as its flags. Secure keeps it off plain HTTP, HttpOnly keeps it out of reach of page scripts, and SameSite decides whether it rides along on cross-site requests. Miss one and a cookie that looks fine becomes the way an account is taken over. The rules are not hard, but they are easy to forget on the one cookie that matters.

Paste one or more Set-Cookie headers, with or without the header name, and this reports the flags on each cookie and the ones worth reviewing - including the __Host- and __Secure- prefix rules the browser enforces silently, and a Domain attribute that quietly widens a cookie to every subdomain. It runs entirely in your browser - nothing you paste is sent anywhere, and this tool does not contact, scan or attack any website. Only review systems you own or are authorised to assess.

Frequently asked questions

No. The header you paste is parsed by JavaScript on this page and never leaves your browser. The tool has no server to send it to and makes no network request of any kind.

They are enforced by the browser. A __Secure- cookie is only accepted if it has the Secure flag; a __Host- cookie must also have no Domain attribute and Path=/. A cookie that names the prefix but breaks the rule is silently dropped, which this tool points out.

Not always - a cookie a page legitimately reads in JavaScript cannot have it. But a session or authentication cookie should have HttpOnly so that a cross-site scripting flaw cannot read it. The tool flags the absence so you can make that judgement deliberately.