HTTP Cookie Decoder & Parser
A cookie decoder tool turns a raw Cookie or Set-Cookie string into fields you can actually read.
That matters when you are debugging a login loop, checking whether SameSite=None is paired with Secure, or trying to tell whether a cookie value is plain text, Base64, URL-encoded data, or a token format such as JWT. A good decoder saves time because it separates the name, value, domain, path, expiry, and security flags in one view instead of making you read one long header string by eye.
Cookie strings are parsed in your browser only. Nothing is uploaded or stored on a server. Avoid pasting live session tokens on shared machines.
How this tool works
A cookie decoder tool parses cookie syntax. It does not break encryption. If you paste a Set-Cookie header like 'Set-Cookie: session=eyJ1aWQiOjEyMywicm9sZSI6Im1lbWJlciJ9; Path=/; HttpOnly; Secure; SameSite=Lax', a parser can split the cookie into Name (session), Value (eyJ1aWQiOjEyMywicm9sZSI6Im1lbWJlciJ9), Path (/), HttpOnly (true), Secure (true), and SameSite (Lax). That is structural decoding. If you want to inspect the value itself, you may need one more step. In this example the value is Base64 text, so you would copy it into the Base64 Encoder / Decoder and get readable JSON back. If the value is encrypted, no public decoder can turn it into useful text without the server-side key.
Worked example
Cookie parsing is most useful when a cookie is present in a response but missing on the next request. Start with this response header: 'Set-Cookie: auth_token=abc123; Path=/; SameSite=None'. A cookie decoder shows two important things fast: (1) The cookie has SameSite=None. (2) The cookie does not have Secure. Current browser guidance is clear on this point: cookies marked SameSite=None must also use Secure. Without it, modern browsers can reject the cookie in cross-site contexts. That means the app may look like it set the cookie even though the browser never keeps it in a usable way.
Related tools
Frequently asked questions
What is a cookie decoder tool?
A cookie decoder tool parses a raw cookie string into readable fields such as name, value, domain, path, expiry, Secure, HttpOnly, and SameSite.
Does a cookie decoder decrypt secure session cookies?
No. It can parse the cookie structure and sometimes decode plain encodings such as Base64 or URL encoding, but encrypted values still need the server-side key.
Is my cookie data sent to a server?
No. OnSumo's Cookie Decoder runs entirely in the browser. Cookie strings you paste are processed locally by JavaScript on your device and are never uploaded to OnSumo servers.
What does HttpOnly mean?
HttpOnly means browser JavaScript cannot read the cookie with document.cookie. The browser can still send it in HTTP requests.
What is the difference between Expires and Max-Age?
Both control the cookie lifetime. Expires uses a fixed date and time. Max-Age uses a number of seconds. When both appear, Max-Age takes precedence.
Why does my cookie value look like gibberish?
It is often encoded, compressed, signed, or encrypted. Base64 and URL-encoded values can be decoded with companion tools. Encrypted values cannot be read without the key used by the application.
How do I view cookie details in Chrome?
Open DevTools, then check Application > Cookies for stored cookies or Network for raw Set-Cookie headers. Chrome's docs also note you can show URL-decoded cookie values in DevTools.