A cookie string is the text that carries cookies between a browser and a server. There are two kinds. A Cookie header is sent by the browser and lists cookies as name=value pairs separated by semicolons. A Set-Cookie header is sent by the server and defines one cookie, followed by attributes such as Domain, Path, Expires, Max-Age, Secure, HttpOnly, and SameSite. Editing these by hand is easy to get wrong: a stray semicolon, a missing Secure, or a badly formatted date can make a browser ignore the cookie.

Tool description

This tool lets you edit a cookie string in a form. Paste a Cookie or Set-Cookie header and each cookie appears as a card with fields for its name, value, and attributes. Change a field, add a cookie, or remove one, and the text is rewritten right away, so you can copy the result when you are done. You can also keep typing in the text box, and the form follows. The tool detects the header type from what you paste, and you can switch between Cookie and Set-Cookie at any time. Attributes the form has no field for, such as Priority, are kept in an "Other attributes" field, so nothing is lost. Everything happens in your browser, and your cookies are not sent anywhere.

The tool also warns about common mistakes: SameSite=None or Partitioned without Secure, __Secure- and __Host- cookies that break their prefix rules, invalid dates, non-numeric Max-Age, and names or values that contain characters that break the header.

Examples

Start with this Set-Cookie header:

Set-Cookie: session=abc123; Path=/; HttpOnly

Turn on Secure, set SameSite to Strict, and set Max-Age to 3600. The text becomes:

Set-Cookie: session=abc123; Max-Age=3600; Path=/; Secure; HttpOnly; SameSite=Strict

Switch to Cookie to get the header a browser would send back:

Cookie: session=abc123