← Back to Tools

🍪 Cookie Security Analyzer

Paste a Set-Cookie header to check its security attributes and understand what each flag does.

Paste the value of a Set-Cookie header (with or without the 'Set-Cookie:' prefix).

📚 Why cookie flags matter

Cookies are the most common way web apps maintain login sessions. A poorly configured session cookie is often the easiest path for an attacker to hijack an authenticated session.

Without HttpOnly: Any JavaScript on the page (including injected XSS) can read document.cookie and steal your session token.

Without Secure: If a user ever visits the HTTP version of your site, the browser sends the cookie in plaintext — visible to anyone on the same network.

Without SameSite: The cookie is sent on cross-site requests — enabling CSRF attacks where another site tricks the browser into making requests to yours.

How to use this tool

  1. 1 Enter a website URL in the input field.
  2. 2 Click Analyze.
  3. 3 The tool loads the page and inspects all cookies set by the server.
  4. 4 Check each cookie's attributes: Secure, HttpOnly, SameSite, expiry, and domain scope.

Frequently asked questions

What does the Secure flag do?
It prevents the cookie from being sent over unencrypted HTTP connections, protecting it from interception on unsecured networks.
What does HttpOnly mean?
HttpOnly blocks JavaScript from reading the cookie, which prevents session token theft through XSS attacks.
What is SameSite?
SameSite controls whether cookies are sent with cross-site requests. Lax or Strict settings help prevent CSRF attacks.
Which cookies are most security sensitive?
Session cookies and authentication tokens are highest priority. These should always have Secure and HttpOnly flags and a short expiry.

You might also like

🛡️ Security Headers Checker Inspect a website's HTTP security headers, understand what each one does, and s… 🧱 CSP Analyzer Analyze a Content-Security-Policy header for dangerous directives — unsafe-inli… 🧱 CSP Generator Build a Content-Security-Policy header interactively — toggle directives, add a… 📄 Security.txt Generator Generate a RFC 9116-compliant security.txt file for your domain — the standard …