cookie security flags
Every flag on a Set-Cookie is a separate instruction for the browser, and the three that matter most each control a different attack: Secure decides whether the cookie travels over plaintext HTTP, HttpOnly decides whether JavaScript can read the value, and SameSite decides whether the cookie rides along on requests fired from another site. A session cookie missing all three is vulnerable to three different attacks at once.
The __Host- prefix requires Secure, Path=/ and no Domain all at once; since all three conditions are met, the browser accepts the cookie with the strictest possible scope, locked to the exact host.
The name "sid" matches the session/token pattern the tool recognizes, and since HttpOnly is missing, it adds one extra warning: an XSS on the page could read this value directly via JavaScript.
The spec requires Secure whenever SameSite=None is present; without it, the cookie is not just partially ignored, it never gets stored by the browser at all.
Set-Cookie is sent by the server in the response to define a cookie, with all its flags (Secure, HttpOnly, SameSite, etc.). Cookie is sent by the browser in the request and only carries name=value pairs, with no flags. That is why full security analysis is only possible on Set-Cookie cookies.
Because SameSite=None requires the Secure flag alongside it; without it, the browser rejects the cookie entirely instead of merely restricting its use, and this shows no visible error, the cookie simply never gets saved.
__Secure- only requires the Secure flag on the cookie; __Host- is stricter and requires Secure, Path=/ and the complete absence of a Domain attribute, which prevents the cookie from being shared with subdomains.
4096 bytes counting only the name and value (name=value); attributes like Secure, Path and Expires do not count toward that limit, but the browser rejects the entire cookie if name=value goes over it.
No. Without Expires or Max-Age, the cookie is a session cookie and disappears when the browser closes; if you set a very long Max-Age, Chrome automatically truncates it to 400 days from creation, but Firefox and Safari do not enforce that cap yet.
Paste in any format: Set-Cookie, a Cookie header, name=value, or copied from DevTools (Application tab), including tab-separated. Each format is detected automatically.
The tool splits each cookie, reads its security flags and flags risks like missing Secure, HttpOnly and SameSite. Nothing leaves your browser.
For security, this tool does not access any site or use the server as a proxy (which would expose the server IP and SSRF holes). You paste the cookies and all analysis runs locally. Do not paste real session cookies on computers that are not yours.