What is a cookie decoder?

A cookie decoder is a tool that parses HTTP cookie strings into their component parts: name, value, domain, path, expiration time, and security flags like Secure, HttpOnly, and SameSite. Cookies are often stored as semicolon-separated strings that are hard to read at a glance. This tool breaks them down into labeled fields so you can inspect or debug them.

Is my cookie data sent to your server?

No. This tool runs entirely in your browser. Cookie strings you paste are parsed client-side using JavaScript. Nothing is uploaded, logged, or sent to OnSumo servers. If you are analyzing sensitive session cookies or authentication tokens, you can safely use this tool offline (save the page, disconnect from the internet, and parse locally).

What cookie fields does this tool decode?

Standard HTTP cookie attributes: Name (the cookie identifier), Value (the cookie payload, may be encoded or encrypted), Domain (which domain(s) can access the cookie), Path (which URL paths the cookie applies to), Expires / Max-Age (when the cookie expires, converted to readable date), Secure (cookie only sent over HTTPS), HttpOnly (cookie not accessible via JavaScript for XSS protection), and SameSite (cross-site request policy: Strict / Lax / None). If your cookie value is Base64-encoded or URL-encoded, you may need to decode it separately. This tool parses the cookie structure, not encrypted payloads.

Why is my cookie value gibberish?

Cookie values are often Base64-encoded, URL-encoded, or encrypted for security. This tool shows you the raw value from the cookie string — it does not decrypt or decode the value itself. If you need to decode a Base64 value, use a Base64 decoder after extracting the value from this tool. If the value is encrypted (common for session tokens), you need the server-side decryption key.

Can I use this to steal someone's cookies?

No. This tool only parses cookie strings you already have. It does not extract cookies from other people's browsers, intercept network traffic, or bypass HttpOnly protections. If you are trying to access cookies from a site you do not own, you are likely violating that site's terms of service or applicable laws. Use this tool for legitimate debugging, education, or security testing on your own sites only.

How do I get a cookie string to decode?

From your browser: Open DevTools (F12), go to Application (Chrome/Edge) or Storage (Firefox), click Cookies in the sidebar, select a cookie and copy its value. From HTTP headers: Open DevTools → Network tab, click a request, look for Set-Cookie in response headers, and copy the full header value. Paste the copied string into this decoder.

What is SameSite and why does it matter?

SameSite is a cookie attribute that controls whether cookies are sent with cross-site requests. It protects against CSRF (cross-site request forgery) attacks. Strict means cookie only sent for same-site requests. Lax means cookie sent for top-level navigation but not embedded requests. None means cookie sent for all requests (requires Secure flag). If you are debugging why a cookie is not being sent, check the SameSite value — browsers block SameSite=None cookies without the Secure flag, and modern browsers default to Lax if no SameSite is set.

HTTP Cookie Decoder & Parser

Decode and inspect HTTP cookies in your browser. Paste a cookie string or header, and this tool parses it into readable fields: name, value, domain, path, expiry, Secure, HttpOnly, and SameSite flags.

What you get:

Instant cookie parsing (no server upload)
Field breakdown with labels and values
Expiry date conversion (Unix timestamp to human-readable)
Copy-friendly output for documentation or debugging

How to use:

Open your browser DevTools (F12 → Application/Storage → Cookies) or check response headers
Copy the cookie string or Set-Cookie header value
Paste it into the decoder
View parsed fields

Perfect for debugging cookie issues, checking third-party cookies, or understanding tracking pixels — all without sending your cookie data to external servers.

Cookie strings are parsed in your browser only. Nothing is uploaded or stored on a server. Avoid pasting live session tokens on shared machines.

Input modeCookie string

URL-decode valueAuto-detect Base64 in value

How does the Cookie Decoder work step by step?

A cookie decoder tool parses cookie syntax. It does not break encryption. If you paste a Set-Cookie header like 'Set-Cookie: session=eyJ1aWQiOjEyMywicm9sZSI6Im1lbWJlciJ9; Path=/; HttpOnly; Secure; SameSite=Lax', a parser can split the cookie into Name (session), Value (eyJ1aWQiOjEyMywicm9sZSI6Im1lbWJlciJ9), Path (/), HttpOnly (true), Secure (true), and SameSite (Lax). That is structural decoding. If you want to inspect the value itself, you may need one more step. In this example the value is Base64 text, so you would copy it into the Base64 Encoder / Decoder and get readable JSON back. If the value is encrypted, no public decoder can turn it into useful text without the server-side key.

What does a typical Cookie Decoder result look like?

Cookie parsing is most useful when a cookie is present in a response but missing on the next request. Start with this response header: 'Set-Cookie: auth_token=abc123; Path=/; SameSite=None'. A cookie decoder shows two important things fast: (1) The cookie has SameSite=None. (2) The cookie does not have Secure. Current browser guidance is clear on this point: cookies marked SameSite=None must also use Secure. Without it, modern browsers can reject the cookie in cross-site contexts. That means the app may look like it set the cookie even though the browser never keeps it in a usable way.

Related tools

Frequently asked questions

What is a cookie decoder?
A cookie decoder is a tool that parses HTTP cookie strings into their component parts: name, value, domain, path, expiration time, and security flags like Secure, HttpOnly, and SameSite. Cookies are often stored as semicolon-separated strings that are hard to read at a glance. This tool breaks them down into labeled fields so you can inspect or debug them.
Is my cookie data sent to your server?
No. This tool runs entirely in your browser. Cookie strings you paste are parsed client-side using JavaScript. Nothing is uploaded, logged, or sent to OnSumo servers. If you are analyzing sensitive session cookies or authentication tokens, you can safely use this tool offline (save the page, disconnect from the internet, and parse locally).
What cookie fields does this tool decode?
Standard HTTP cookie attributes: Name (the cookie identifier), Value (the cookie payload, may be encoded or encrypted), Domain (which domain(s) can access the cookie), Path (which URL paths the cookie applies to), Expires / Max-Age (when the cookie expires, converted to readable date), Secure (cookie only sent over HTTPS), HttpOnly (cookie not accessible via JavaScript for XSS protection), and SameSite (cross-site request policy: Strict / Lax / None). If your cookie value is Base64-encoded or URL-encoded, you may need to decode it separately. This tool parses the cookie structure, not encrypted payloads.
Why is my cookie value gibberish?
Cookie values are often Base64-encoded, URL-encoded, or encrypted for security. This tool shows you the raw value from the cookie string — it does not decrypt or decode the value itself. If you need to decode a Base64 value, use a Base64 decoder after extracting the value from this tool. If the value is encrypted (common for session tokens), you need the server-side decryption key.
Can I use this to steal someone's cookies?
No. This tool only parses cookie strings you already have. It does not extract cookies from other people's browsers, intercept network traffic, or bypass HttpOnly protections. If you are trying to access cookies from a site you do not own, you are likely violating that site's terms of service or applicable laws. Use this tool for legitimate debugging, education, or security testing on your own sites only.
How do I get a cookie string to decode?
From your browser: Open DevTools (F12), go to Application (Chrome/Edge) or Storage (Firefox), click Cookies in the sidebar, select a cookie and copy its value. From HTTP headers: Open DevTools → Network tab, click a request, look for Set-Cookie in response headers, and copy the full header value. Paste the copied string into this decoder.
What is SameSite and why does it matter?
SameSite is a cookie attribute that controls whether cookies are sent with cross-site requests. It protects against CSRF (cross-site request forgery) attacks. Strict means cookie only sent for same-site requests. Lax means cookie sent for top-level navigation but not embedded requests. None means cookie sent for all requests (requires Secure flag). If you are debugging why a cookie is not being sent, check the SameSite value — browsers block SameSite=None cookies without the Secure flag, and modern browsers default to Lax if no SameSite is set.