Break a Set-Cookie header into its attributes and find what makes a browser reject it
Paste one or more Set-Cookie lines to see the attribute breakdown and the problems found.
Set-Cookie is the response header a server uses to store a cookie in the browser. The format is name=value; attribute; attribute=value. Everything before the first semicolon is the name and value; everything after it is an attribute. Order does not matter. A browser silently drops attributes it does not know, so a misspelled attribute never raises an error, it just stops working. That is why this tool lists unrecognised attributes.
The common trouble is a cookie that you set but the browser never stored. Most of the time the cause is the combination of attributes, not the value. DevTools will tell you the cookie was not stored, but not always which rule it broke.
| Condition | Result |
|---|---|
SameSite=None without Secure | Not stored |
__Secure- name without Secure | Not stored |
__Host- name with a Domain | Not stored |
__Host- name whose Path is not / | Not stored |
| Name plus value over 4096 bytes | Not stored (common limit) |
With neither Max-Age nor Expires, the cookie is a session cookie and disappears when the browser closes. When both are present, Max-Age wins. A Max-Age whose value is not an integer is dropped entirely, so Max-Age=1w does not mean one week, it means no expiry at all. This tool always shows which attribute decided the lifetime.
The analysis runs entirely in your browser; nothing you paste is sent to a server. The rules come from RFC 6265 and the later cookie specification work covering SameSite, name prefixes and Partitioned.
SameSite=None requires Secure. Major browsers reject a SameSite=None cookie that has no Secure attribute. Serve the page over HTTPS and always add Secure.
Max-Age wins. RFC 6265 says Max-Age takes precedence when both are present. Sending Expires as well is still common for old clients that do not understand Max-Age.
A __Host- name has three requirements: Secure must be present, Domain must be absent, and Path must be exactly /. Missing any one of them makes the browser reject the cookie. Because Domain is absent, the cookie is not sent to subdomains.
No. The analysis runs entirely in JavaScript in your browser. Nothing you paste leaves the page, so pasting a real session id does not expose it.