PixelOkay
Local-only analysis
Tools
PIXELOKAY DEVELOPER WORKSPACE

HTTP Cookie Inspector

Decode cookie headers. See expiration and scope. Understand security flags—without sending private session data anywhere.

Set-Cookie + CookieSecurity diagnosticsRedacted exports

Inspection workspace

Paste headers, review security, test URL scope, and export findings.

03

Analysis results

See what your cookies are doing.

Paste Set-Cookie response headers or a Cookie request header to inspect attributes and security hints. Or explore our harmless example.

UNDERSTAND THE HEADERS

The details behind every cookie.

Set-Cookie vs Cookie

Set-Cookie is a server response containing attributes. Cookie is a request containing only name/value pairs, so its security flags and expiry cannot be reconstructed.

Lifetime & precedence

Max-Age overrides Expires. Zero or negative Max-Age asks browsers to delete the cookie. Without either, a cookie normally lasts for a browser session.

Security context matters

Secure, HttpOnly, SameSite, prefixes and Partitioned affect handling. Actual acceptance depends on the browser, origin and user privacy policy.

For details, read the MDN Set-Cookie reference and the HTTP working-group cookie draft.

Using HTTP Cookie Inspector

Paste request or response cookie headers to inspect attributes, advisory URL scope and lifetime, and decode JSON or JWT text without contacting the origin.

Workflow

  1. Paste a Cookie or Set-Cookie header and optionally provide a URL for advisory scope checks
  2. review parsed attributes and warnings with values redacted by default
  3. export redacted JSON or CSV, and explicitly confirm before including sensitive values.

Example

Compare a Set-Cookie header with the intended URL, review Secure, SameSite and expiration diagnostics, then export a redacted report for review without sending a request to that site.

Limits and data handling

The tool parses pasted headers and does not read the browser cookie store or fetch the supplied origin. Scope checks do not prove browser acceptance or delivery, and there is no complete public-suffix database. JWT decoding does not verify signatures. Redaction is not anonymization because names and scope metadata remain. Sensitive exports require confirmation. Input is bounded to 240,000 characters and 600 entries.

FAQs

Can it show cookies stored in my browser?

No. It only analyzes headers that you paste; it cannot access the browser cookie store.

Does decoding a JWT verify its signature?

No. It displays decoded content only and does not verify the token signature.

Related tools