Skip to main content

Cookie Security Analyzer

Check Secure, HttpOnly, SameSite flags and security prefixes

Paste Set-Cookie headers

One cookie per line. Get headers from browser DevTools → Network → Response Headers → set-cookie.

About the Cookie Analyzer

Cookies carry session tokens, CSRF protections, and tracking identifiers — making them a prime attack target. The Secure flag prevents transmission over HTTP, HttpOnly blocks JavaScript access (XSS mitigation), SameSite prevents CSRF attacks, and the __Host- prefix locks cookies to a specific domain and path.

Paste any Set-Cookie header and this analyzer checks every security flag, scores the cookie 0-100, and lists specific issues with recommendations. Session cookies, authentication tokens, and CSRF tokens each have different requirements — the analyzer flags what matters for each.

How to use

  1. Open DevTools, go to Network, and find the set-cookie response header.
  2. Paste it here (one cookie per line).
  3. Review the security score and specific issues.
  4. Fix missing flags in your server configuration.

Frequently Asked Questions

What is the __Host- prefix? ▾

Cookies named with __Host- must have the Secure flag, no Domain attribute, and Path=/. This locks them to the exact host, preventing subdomain-based cookie injection attacks.

When should I use SameSite=None? ▾

Only for cross-site use cases like third-party embeds or payment redirects — and always with the Secure flag. SameSite=Lax is the safe default that prevents CSRF in most scenarios.

Are session cookies (no expiry) more secure? ▾

Yes — cookies without Max-Age or Expires are cleared when the browser closes, reducing the window for theft. Only use persistent cookies for "remember me" features.

Is this tool free to use? ▾

Yes! This tool is 100% free. No signup, no credit card, no limits. It's part of Formatho's privacy-first developer toolkit.

Is my data safe? Does this tool send data to a server? ▾

Absolutely. This tool runs entirely in your browser. Your data never leaves your device. Zero server-side processing, zero tracking.