Cookie Security Checker

Check pasted Set-Cookie headers for security flags.

Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.

Set-Cookie headers (paste, one per line)

How to use this tool

Enter your values in the fields above.
Press Generate to see the result.
Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.

Pasting a session cookie with Secure, HttpOnly and SameSite=Lax reports all three flags present.

Only pasted headers are checked. This does not inspect live sites or your browser cookies, and flag presence alone does not prove a cookie is safe.

Why does HttpOnly matter?

It keeps the cookie out of reach of page scripts, which reduces the damage if a cross-site scripting flaw exists.

Is a session cookie without expiry a problem?

Not by itself. Session cookies end when the browser closes, so the tool reports it as information, not a failure.

Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.

Live

Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.

Live

Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).

Live