Skip to content
/web local tool
Suggest an improvement

Cookie Header Inspector

Paste Cookie headers, diagnose Domain and Path scope conflicts, or build a host-bound CHIPS policy for a third-party iframe without uploading values.

Local execution receiptinput path disclosedTool content stays out of MonoTools URLs and API requests.
Working input
Browser memory
Cross-tool handoff
Session only · 10 min
URL payload
Never
Export
Explicit action

Verify it: open DevTools Network, clear the log, use the tool, then inspect fetch/XHR requests. Page assets and optional aggregate analytics may use the network; tool input is not included.

Full privacy model
Loading tool...
01

How to use

  1. 01Choose request Cookie, response Set-Cookie, or Builder so the correct grammar and duplicate semantics are used.
  2. 02Review syntax, prefix, SameSite, expiry, Domain, Path and Partitioned diagnostics, including same-name cookies that use different scopes.
  3. 03For an embedded widget, load the third-party iframe preset and replace the opaque sample handle with your short-lived server-issued value.
  4. 04Copy or download JSON, reports, or a generated header; use explicit one-time handoffs for redacted policy review or raw secret scanning.
02

FAQ

Does the parser URL-decode cookie values?
No. Percent escapes remain part of the canonical value because Cookie does not require URL encoding. An optional raw-only preview can show a valid decoded form without replacing the source.
Does this read my browser cookies?
No. You paste headers manually; the tool does not access document.cookie, the Cookie Store API, request origins or the browser cookie jar.
Can it prove a Domain or prefixed cookie will be accepted?
It validates deterministic syntax and __Secure-, __Host-, __Http- and __Host-Http- attribute contracts, but it cannot prove HTTPS origin, domain-match, public-suffix acceptance or user-agent policy without deployment context.
Does the third-party iframe preset guarantee persistence?
No. It builds a host-bound Partitioned cookie candidate for CHIPS-capable browsers. Test real iframe writes and reads in every supported browser, keep the server as the source of truth, and provide an explicit fallback when storage is unavailable.
How are secrets protected?
Every primary cookie value is redacted in JSON, headers and inventory by default, and reports always omit values. Raw values are revealed or sent to Secret Scanner only through explicit controls.
03

Related tools