Cookie Encoder/Decoder
100% LocalEncode cookie pairs and decode Cookie headers.
Cookie encoder/decoder
Encode cookie name/value safely and decode Cookie headers into readable key‑value pairs.
Paste a Cookie header from browser DevTools or cURL. The tool decodes it into readable key/value pairs.
Learn More
What is Cookie Encoder/Decoder?
Frequently Asked Questions
Technical Deep Dive
Cookie Encoder/Decoder
Safely encode cookie name/value pairs and decode Cookie headers into readable key‑value lists. Everything runs locally.
Spec-Compliant
Follows the RFC or de-facto encoding rules, no custom dialects, no surprises.
Lossless Round-Trip
Encode then decode and you get back exactly what you put in, byte for byte.
Handles Edge Cases
Unicode, padding, invalid input, surfaced clearly instead of silently mangling output.
01 Header Specification Matrix
| Context | Header Direction | Format | Attribute Support |
|---|---|---|---|
| Request | Client → Server | name=value; ... | None |
| Response | Server → Client | name=value; Path=/; ... | Full (Max-Age, etc.) |
| Persistence | Browser Cache | Binary / SQLite | Internal Only |
02 Encoding Pipeline
encodeURIComponent to neutralize control characters, whitespace, and separators.
k=v pairs, following the token restrictions defined in RFC 7230.
; (semicolon + space) to produce the final Cookie header string.
03 Common Cookie Security Pitfalls
-
Missing HttpOnly flag Without HttpOnly, any XSS vulnerability allows JavaScript to steal session cookies via
document.cookie. Always set HttpOnly on authentication tokens and session identifiers. The only cookies that should be readable by JavaScript are UI preference cookies (theme, language). -
SameSite=None without Secure Modern browsers reject
SameSite=Nonecookies unless they also carry theSecureflag (HTTPS only). If you need cross-site cookie delivery (embedded widgets, OAuth flows), both attributes are mandatory. Chrome and Firefox enforce this strictly since 2020. -
Overly broad Domain attribute Setting
Domain=.example.commakes the cookie accessible to every subdomain, including potentially untrusted ones likeuser-uploads.example.com. Omit the Domain attribute entirely unless you specifically need cross-subdomain sharing, browsers then restrict the cookie to the exact origin host. -
Cookie prefixes for defense in depth Prefix cookie names with
__Host-or__Secure-to enforce browser-level restrictions.__Host-cookies must be set from a secure origin, must not have a Domain attribute, and must have Path=/. This prevents subdomain hijacking and man-in-the-middle cookie injection attacks.
04 Related Tools
Cookies work alongside other web security and encoding mechanisms. These tools complement the Cookie Encoder for common debugging workflows.
Cookie Parser
Parse and inspect Set-Cookie response headers with all directives: Domain, Path, Expires, Max-Age, Secure, HttpOnly, SameSite.
JWT Decoder
Decode and inspect JWT tokens commonly stored in cookies for authentication and session management.
URL Encoder
Cookie values use the same percent-encoding as URLs. Debug encoding issues across both contexts.