Cookie policy inspection

Review declarations without reading the cookie store

Paste Set-Cookie response fields from an application you own or are authorised to inspect. This tool parses the supplied declaration in the already loaded browser page. It does not read document.cookie, the Cookie Store API, browser storage or request history, and it does not upload cookie names or values. Reports use generic Cookie 01 style identifiers. Analysed means the declaration fit this bounded profile; it does not mean the browser accepted, persisted or sent the cookie.

Separate attributes from actual browser behavior

The report records Secure, HttpOnly, SameSite, Partitioned, Domain, Path, Max-Age and Expires declarations. SameSite=None without Secure and Partitioned without Secure are structural warnings. Secure on a response marked HTTP is highlighted, but loopback exceptions, redirects and upgrade behavior are not guessed. A missing SameSite declaration is recorded as unspecified rather than replaced with a browser default. Expires is recorded as declared but its HTTP-date and clock effect are not evaluated.

Check cookie prefixes conservatively

The case-sensitive __Host- prefix is checked for Secure, Path=/ and absence of Domain. The __Secure- prefix is checked for Secure. Those checks describe the supplied line only: they do not prove that the response host, public suffix rules, TLS state or browser storage conditions allowed the cookie. Domain attributes are therefore marked as requiring request-host context, and the raw Domain value is never placed in the report or export.

Preserve ambiguity instead of choosing a winner

Repeated recognized attributes are marked ambiguous rather than silently applying a last-attribute rule. Unknown attributes and boolean attributes with values make the evidence partial. Max-Age is parsed only within a bounded signed integer profile; zero or negative values are described as deletion or expiry instructions. When Max-Age and Expires are both supplied, the report records that relationship instead of adding the two lifetimes. Invalid cookie pairs remain generic invalid observations so their names and values are not echoed.

Understand what HttpOnly and SameSite evidence cannot prove

HttpOnly is a response declaration whose purpose is to restrict script visibility; document.cookie cannot reconstruct HttpOnly cookies or the attributes that created visible cookies, so this utility intentionally does not use it as an audit source. SameSite behavior depends on the top-level site, request method, navigation and browser policy. Partitioning similarly depends on browser support and partition keys. Reproduce storage and request behavior in the actual application when those details matter.

Limits, local processing and redacted export

Input is limited to 32 KiB, sixty-four Set-Cookie lines, 4096 characters per line and twenty-four attributes per line. Cookie names and values are validated only enough to bound this structural profile and are never copied into results. The local runtime blocks new network connections. Analyse, export and Clear do not create admission, telemetry or persistent-storage operations. Clear, reload and page lifecycle transitions remove displayed inputs and results. The explicit export contains only generic identifiers, booleans, enumerated classifications, note codes and numeric limits.

Method references and related tools

RFC 6265 HTTP State Management defines the established cookie model. Browser privacy, SameSite and partitioning behavior can evolve beyond that baseline, so this diagnostic makes only the bounded declarations documented above.

Cross-origin isolation · All tools · Overall measurement methodology