HTTP Cookie Parser

About GeekFormat

HTTP Cookie Parser

Parse browser-sent Cookie headers. Quickly view key-value pairs, URL encoding, and duplicate name occurrences.

Parse Result

4 Cookie(s)

#1session

Original value: abc123

Decoded value: abc123

#2theme

Original value: dark

Decoded value: dark

#3locale

Original value: zh-CN

Decoded value: zh-CN

#4callback

Original value: https%3A%2F%2Fgeekformat.com%2Fdone

Decoded value: https://geekformat.com/done

JSON Preview

[
  {
    "index": 0,
    "raw": "session=abc123",
    "name": "session",
    "value": "abc123",
    "decodedValue": "abc123"
  },
  {
    "index": 1,
    "raw": "theme=dark",
    "name": "theme",
    "value": "dark",
    "decodedValue": "dark"
  },
  {
    "index": 2,
    "raw": "locale=zh-CN",
    "name": "locale",
    "value": "zh-CN",
    "decodedValue": "zh-CN"
  },
  {
    "index": 3,
    "raw": "callback=https%3A%2F%2Fgeekformat.com%2Fdone",
    "name": "callback",
    "value": "https%3A%2F%2Fgeekformat.com%2Fdone",
    "decodedValue": "https://geekformat.com/done"
  }
]

Break down Cookie request headers without guessing attributes — see exactly what the current request carries.

Set-Cookie Parser

Cookie Parser

cURL to Code Generator

Authentication Header Generator

URL Encode

JWT Decode, Verify & Generate

What is an HTTP Cookie Parser?

An HTTP Cookie Parser is a debugging tool built specifically for the `Cookie:` request header and the `document.cookie` string. The core problem it solves is not "what are cookies," but the real-world scenarios developers, QA engineers, scraping engineers, and DevOps encounter during integration: exactly which cookies the browser is sending, whether a value is URL-encoded, whether duplicate names exist, and how to copy the current Cookie header as-is into curl, Postman, or scripts to reproduce issues.

Unlike the `Set-Cookie` response header, cookies in an HTTP request header are a flat list of `name=value` pairs. It only tells you "what was actually sent in the current request" and does not include attributes such as SameSite, HttpOnly, Secure, Path, Domain, Expires, or Max-Age. That is why when you are troubleshooting "why the API doesn't recognize my login state," "which cookie is missing in my browser request," or "why does this value in document.cookie look like garbage," a request header parser is far more direct than a general-purpose cookie tool.

A common naive implementation simply calls `split(';')` and renders each string, but for real debugging that is far from enough. You also need to know whether values are URL-encoded, whether duplicate names exist, whether the normalized header can be copied directly, and whether the parsed result can be reused by scripts or documentation. This page is designed around those real developer actions.

If what you need to inspect is not "what was sent in the request" but "why the browser rejected a Set-Cookie directive from the server," you should not stay on this page — head over to the "Set-Cookie Parser" which is better suited for inspecting response header attributes. So the positioning is clear: this is a Cookie request header / document.cookie debugger, not a response header attribute auditor.

Use Cases

Troubleshoot lost login state or session anomalies by checking exactly which cookies are present in the request header
Debug URL-encoded cookies by comparing raw and decoded values to verify actual content
Check whether multiple cookies with the same name are causing browser or server-side processing anomalies
Quickly normalize a browser Cookie header and copy it into Postman, curl, or scripts to reproduce requests
Analyze document.cookie output to confirm which cookies are visible to the frontend

How to Use

Paste a Cookie request header or document.cookie string into the input area
View each cookie's name, raw value, and URL-decoded value
Check for duplicate name warnings and the normalized Cookie header result
Copy the normalized Cookie header or view the JSON preview for further debugging

Features

Automatic multi-cookie splitting: Parses Cookie request headers and document.cookie strings item by item using semicolon separators
Dual value display: Shows both raw and URL-decoded values to quickly pinpoint encoding issues
Duplicate name detection: Automatically identifies cookies with the same name and flags potential conflicts
Normalized output: One-click copy of the standardized Cookie request header for continued API debugging
JSON preview: Structured output of parsed results for scripts, logs, and testing tools
Local processing: All parsing happens in the browser; input is never uploaded to any server

How to choose between this page and the other two Cookie tools?

First figure out whether you have a request header, document.cookie, or a server-side Set-Cookie response header in hand, then pick the right page.

Tool	Best for input	Best suited for	Core strength
HTTP Cookie Parser (current page)	Cookie request header, document.cookie	Checking which cookies were actually sent in the request, whether values are encoded, and whether duplicate names exist	Focused on request header breakdown, normalized copy, URL decoding, and duplicate detection
Set-Cookie Parser	Set-Cookie response header returned by the server	Troubleshooting why the browser rejects cookies and checking whether SameSite / Secure / HttpOnly / Path / Domain settings pose risks	Deeper attribute breakdown with security configuration warningsOpen Set-Cookie Parser
Cookie Parser	Mixed Cookie string and Set-Cookie debugging scenarios	When your data source is uncertain, or you need a unified entry point to quickly route to the right tool	Dual-mode switching with Netscape Cookie File export supportOpen Cookie Parser

Best Practices

Confirm you are looking at a request header, not a response header

If the text comes from Request Headers in browser DevTools, a captured request, document.cookie, or a Cookie header in server logs, this page is the right fit. If it comes from the Set-Cookie in Response Headers, do not continue analyzing attribute issues here.

Keep the raw value, then check the decoded value

When debugging cookie issues, don't stare only at the decoded content. The raw value is what was actually transmitted; the decoded value is merely a reading aid. For signatures, Base64, JWT, or double-encoding scenarios the raw value is especially important.

JWT Tool

Don't rush to delete when you see duplicate names

Duplicate cookies can be the root cause of the problem, especially when Path / Domain differ, environments are switched, or historical writes are left behind. Keep the duplicates and record them, then cross-check against browser behavior and server settings.

Prefer copying the normalized header when reproducing requests

When you need to feed the current Cookie header into curl, Postman, or test scripts, copying the normalized result directly reduces reproduction bias caused by extra spaces, newlines, and formatting noise.

curl to Code

FAQ

What kind of Cookie input is this page designed for?

It is specifically designed for parsing the Cookie request header and `document.cookie` style flat strings such as `session=abc123; theme=dark`. If you have a `Set-Cookie` response header returned by a server, you should switch to the dedicated "Set-Cookie Parser" instead, because request header Cookies do not include attributes like SameSite, HttpOnly, Secure, Path, or Domain.

Set-Cookie Parser

Why do Cookie values look like garbled text?

Many Cookie values are URL-encoded; for example `%3D` represents `=` and `%2F` represents `/`. This tool displays both the raw value and the URL-decoded value side by side, so you can quickly verify the actual content instead of struggling to read encoded strings.

Why detect duplicate Cookie names?

Cookies with the same name may come from different Paths, different Domains, or leftover writes from previous states. Although the request header is just a flat list of `name=value` pairs, duplicate names often indicate inconsistent browser behavior or server-side processing issues, so the tool highlights them proactively instead of silently overwriting.

Is it suitable for troubleshooting login state and session issues?

Yes. Paste the actual Cookie header sent by your browser request to view each cookie's name, raw value, and decoded value at a glance, making it easy to spot missing session fields, encoding corruption, or confusion caused by duplicate cookie names.

Can the parsed result be used directly for API debugging?

Yes. The tool generates a normalized Cookie header that you can copy with one click into curl, Postman, scripts, or API debugging platforms to reproduce issues. It also supports JSON preview for logs, issue reports, and test case documentation.

Why doesn't this page show SameSite, HttpOnly, or Secure?

Because those attributes only exist in the `Set-Cookie` response header; they do not appear in the `Cookie` request header that the browser sends on subsequent requests. This page focuses on "what was actually sent in the request" rather than "what the server originally set."

Are document.cookie and the Cookie request header the same thing?

They look similar — both are flat `name=value; name2=value2` structures — but there are differences: `document.cookie` cannot read HttpOnly cookies, while the Cookie request header is the final set that the browser automatically sends based on the current scope. This parser handles both types of flat input.

Will the cookies I paste be uploaded to a server?

No. All parsing, URL decoding, duplicate detection, and JSON preview run entirely in your browser locally. Your sessions, tokens, login state cookies, and user data are never sent to any server.

Glossary

Cookie Request Header: The collection of cookie name-value pairs that the browser automatically sends in an HTTP request, typically formatted as `name1=value1; name2=value2`. It reflects the cookies actually sent in the current request and does not include security attributes.Set-Cookie Parser
document.cookie: The JavaScript interface on the frontend that lets you read cookies as a string. It usually has a similar structure to the Cookie request header, but it cannot read HttpOnly cookies and cannot be used to reverse-engineer the complete Set-Cookie configuration.
URL-encoded Cookie Value: Cookie values use percent-encoding to safely transmit special characters, such as `%3D`, `%2F`, and `%3A`. During debugging you usually need to inspect both the raw value and the decoded value.URL Encode Tool
Duplicate Cookie Name: Multiple cookies with the same name appearing in a single request header. They may come from different Paths, different Domains, or leftover old values, and are often an important clue for session anomalies and inconsistent behavior.
Normalized Cookie Header: Input content cleaned and re-assembled into a canonical `name=value; name2=value2` string, making it easy to copy into curl, scripts, Postman, or logs to continue reproducing issues.

Cookie Request Header vs Set-Cookie Response Header

Many cookie debugging pitfalls are caused by mixing up request headers and response headers.

Item	Cookie Request Header	Set-Cookie Response Header
Where it appears	In the request the browser sends to the server	In the response the server sends back to the browser
Typical format	name1=value1; name2=value2	name=value; Path=/; HttpOnly; Secure
Includes attributes	No	Yes — SameSite / Path / Domain / Expires / Max-Age, etc.
Best for troubleshooting	What was actually sent in the request	Why the browser rejects a cookie
Better tool	This page	Set-Cookie Parser

Common Cookie Request Header Debugging Issues

These are the issues you'll encounter most often when working with request header cookies.

Symptom	Likely cause	Check first
API doesn't recognize login state	The request didn't include the target cookie at all, or the name/value don't match	First confirm whether the target session field appears in the normalized Cookie header
Cookie values look like garbled text	The values are URL-encoded	Compare the raw value and decoded value side by side
Behavior differs across environments	Duplicate cookie names, leftover old values, or differing browser scope selection	Look at duplicate name warnings and record all same-named entries
Script reproduction fails	Copying introduced extra spaces, newlines, or formatting noise	Re-copy using the normalized Cookie header

Privacy & Security

Cookie request header parsing, URL decoding, duplicate detection, and JSON preview all run locally in your browser. The sessions, tokens, and login cookies you enter are never uploaded to any server.

HTTP Cookie Parser