Contact

Tools  /  Security  /  Cookie Security Checker

SECURITY

Cookie Security Checker

Analyze one or many Set-Cookie headers for real attribute compliance (Secure/HttpOnly/SameSite, __Host-/__Secure- prefix rules, size limits), or build a compliant one from scratch.

More Security tools

HMAC Generator Hash Identifier Random Token Generator UUID Validator OAuth URL Builder Basic Auth Generator

What this tool does

Two modes: Analyze parses one or many pasted Set-Cookie header values and scores each one's actual security attribute configuration, and Build constructs a compliant Set-Cookie header from individual attribute toggles, live-scored as you build it.

The three core attributes

Secure keeps the cookie off plain HTTP connections entirely. HttpOnly keeps it out of reach of JavaScript, closing off the most common cookie-theft path via XSS (skip it only for a cookie deliberately meant to be read by JS, like a CSRF double-submit token). SameSite controls whether the cookie is sent on cross-site requests — Strict or Lax for most cookies, None only when a cookie genuinely needs to work cross-site (and only ever paired with Secure).

SameSite=None without Secure is rejected outright

This isn't just a best-practice suggestion — Chrome, Firefox and Safari all actively reject a cookie with SameSite=None and no Secure attribute. This tool flags that specific combination as a hard error, not a soft warning, since the cookie genuinely won't be set at all in a modern browser.

__Host- and __Secure- name prefixes

A cookie named with the __Host- prefix is only accepted by the browser if it also has Secure, Path=/, and no Domain attribute at all — a browser-enforced guarantee that the cookie can't be overwritten by a sibling subdomain. __Secure- only requires Secure. Both are checked for actual compliance when a cookie's name uses either prefix, not just acknowledged.

Expiry hygiene

A cookie whose name looks like a session or auth token (session, auth, token, jwt, sid) but carries a long Expires/Max-Age is flagged — a persistent, long-lived credential cookie extends the window an attacker who steals it has to use it.

Size limit

Browsers generally cap a single cookie around 4096 bytes (name + value combined) — this tool reports the actual byte size and flags anything approaching that limit.

Build mode

Construct a Set-Cookie header from individual toggles — name, value, domain, path, expiry, SameSite, Secure, HttpOnly, Partitioned (the newer CHIPS attribute for partitioned third-party cookies) — scored live by the same engine Analyze mode uses, so you see the effect of every toggle immediately.

Privacy

Every cookie is parsed, scored and built entirely in your browser. Nothing is uploaded.

FAQ

Frequently asked questions

Why is SameSite=None without Secure flagged as an error, not just a warning?
Because it is one -- Chrome, Firefox and Safari all actively reject a cookie with SameSite=None and no Secure attribute, so that cookie genuinely will not be set in a modern browser, not just "less secure."
What do the __Host- and __Secure- prefixes actually enforce?
A __Host--prefixed cookie is only accepted by the browser if it also has Secure, Path=/, and no Domain attribute -- guaranteeing a sibling subdomain can't overwrite it. __Secure- only requires Secure. Both are browser-enforced, not just naming conventions.
Does every cookie need HttpOnly?
Most do, since it closes off the most common cookie-theft path via XSS -- but a cookie deliberately meant to be read by JavaScript (like a CSRF double-submit token) legitimately needs to skip it, so it's flagged as a recommendation rather than a hard failure.
Why does a long expiry on a session cookie matter?
A persistent, long-lived cookie extends how long a stolen value stays useful to an attacker. A cookie whose name suggests it carries a session or auth token is flagged if it has a long Expires/Max-Age instead of expiring with the browser session.
Can I check multiple cookies at once?
Yes -- paste one Set-Cookie value per line (with or without a leading "Set-Cookie:" label) and each is parsed and scored independently.
What does the size check actually limit?
Browsers generally cap a single cookie around 4096 bytes for its name and value combined -- this tool reports the actual byte size of each cookie and flags anything approaching that limit.
Can this build a cookie for me, not just check one?
Yes -- Build mode constructs a Set-Cookie header from individual attribute toggles, scored live by the same engine Analyze mode uses, so you can see exactly how each toggle affects the result.
Is anything I paste or build sent anywhere?
No. Parsing, scoring and building all happen entirely in your browser -- this tool has no server component.
Theme Accent