security-privacy
Cookie Parser
Parse a Cookie request header or semicolon-separated cookie string locally in your browser, with raw values, decoded values, empty values, and duplicate-name notes.
Tool workspace
The interactive tool requires JavaScript.
Instructions
Choose whether values should be percent-decoded, then parse the string.
Review the name, raw value, decoded value, and notes columns for duplicate names, empty values, truncation, escaping, and copy mistakes.
Paste a Cookie string from developer tools, logs, or documentation and the parser splits it into name-value rows in the current browser. It highlights empty values, duplicate names, and percent-decoding issues without uploading the input or making security or consent claims.
Direct answer
Cookie Parser turns strings such as `name=value; other=123` into a reviewable local table, tries percent-decoding by default, and flags duplicate names, empty values, and decode failures. It does not read browser cookie storage, connect to external services, or replace security audits, privacy compliance, or consent management.
How to use this tool
- Copy a Cookie string from a request header, log, or documentation example. Avoid production session cookies, access tokens, and customer data.
- Choose whether values should be percent-decoded, then parse the string.
- Review the name, raw value, decoded value, and notes columns for duplicate names, empty values, truncation, escaping, and copy mistakes.
What strings this parser is for
Use it for HTTP Cookie request headers, semicolon-separated strings copied from browser developer tools, test fixtures, and documentation examples. It does not read cookie storage from the current site or send requests.
Local parsing and privacy limits
Parsing runs in the current browser and the page does not upload or store the input or result. Still avoid pasting real session cookies, production tokens, customer identifiers, or log fragments you are not allowed to handle.
The result is not a security or compliance decision
The output only shows how the string was split and whether empty values, duplicate names, or decode failures appeared. It does not evaluate HttpOnly, Secure, SameSite, expiration, consent state, cross-site risk, or legal compliance.
Frequently asked questions
Does this tool read cookies from my browser?
No. It only parses the string you paste into the text box and does not read browser cookie storage or visit other sites.
Should I paste a real session cookie?
No. A real session cookie may represent account access. Use test values, redacted logs, or documentation examples in controlled environments.
Why does it flag duplicate names?
Logs, proxies, test scripts, or copy flows can produce repeated cookie names. Duplicate names can affect how a backend reads the header, so they deserve manual review.
Can it tell whether a cookie is secure or compliant?
No. It parses a string only and does not inspect Set-Cookie attributes, consent records, legal requirements, or business security policy.
Last updated: