HTMLCookie Header Inspector
Paste one or more Set-Cookie headers and get a browser-local release review: Secure, HttpOnly, SameSite, Domain, Path, Max-Age, Expires, prefix rules, deletion cookies, and size risks. Exports a cookie rollout checklist, Express and Next.js snippets, and a safe verification pack with redacted cookie fixtures plus a starter Node assertion test. Nothing is uploaded.
Ctrl+Enter to run | Ctrl+K to switch tools | Recent button shows input history
Repeating this work? Turn this kind of browser utility into an API batch, MCP prompt, extension workflow, or shared team recipe.
Buy Pro Browse tool packsFAQ
What can I paste into Cookie Header Inspector?
Paste raw Set-Cookie lines, a copied response header block, or one cookie per line. The tool keeps Expires dates intact and analyzes each cookie separately.
Does it read cookies from my browser?
No. It only inspects text you paste into the page, and the review runs locally in your browser.
What risks does it flag?
It checks missing Secure, missing HttpOnly, missing or unsafe SameSite values, broad Domain scope, non-root Path scope, missing expiration policy, deletion cookies, large values, and __Host- or __Secure- prefix rules.
What is in the verification pack?
The pack includes .env.example, redacted cookie-headers.txt, cookie-assertions.json, and a starter verify-cookie-headers.mjs file. Cookie values are replaced with placeholders so teams can add real private headers locally.
Are the snippets production-ready?
They are reviewed starting points for Express and Next.js. Confirm product-specific domain, path, lifetime, and SameSite choices before release.