Cookie security checker

What is checked

Every Set-Cookie header a page sends, parsed into its individual attributes: Secure, HttpOnly, SameSite, Domain, Path, expiry, and whether the cookie's name claims a __Host- or __Secure- prefix and actually meets that prefix's requirements.

Cookie values are redacted

Only a cookie's length and a short prefix are shown, never the full value. A cookie is very often carrying a live session token, and a tool that exists to be pasted a URL and show what it finds should not become an easy way to expose one - even your own, on a page someone is watching over your shoulder.

What the __Host- and __Secure- prefixes mean

A cookie named with either prefix is a self-enforcing promise, checked by the browser itself before it will even set the cookie: __Secure- requires the Secure attribute; __Host- additionally requires Path=/ and no Domain attribute at all (which locks the cookie to the exact host that set it, with no possibility of it leaking to a subdomain). A cookie claiming one of these prefixes without meeting it is simply never set by the browser - this flags that specific, otherwise-silent failure.

A missing flag is a fact, not automatically a vulnerability

Whether a missing HttpOnly or SameSite actually matters depends on what the cookie is for - a UI preference and a session-authentication cookie carry very different risk from the same missing attribute, and this tool has no way to know which is which. Findings are reported with an explanation, not a verdict.