What does HttpOnly actually prevent?

It stops JavaScript reading the cookie via document.cookie, so an XSS payload can't simply exfiltrate the session identifier. It does not stop the cookie being sent, and it is not a substitute for fixing the XSS.

What does SameSite do?

It controls whether the cookie is attached to cross-site requests. Strict never sends it cross-site, Lax sends it only on top-level navigations, and None sends it always but requires Secure. It is the main built-in CSRF mitigation.

My session cookie value is unreadable — what is it?

Usually a Base64 or Base64URL payload with an HMAC signature appended, or a JWT. Copy the value into the Base64 or JWT decoder to unwrap it.

Are cookie names case sensitive?

Yes, cookie names are case sensitive; the attribute names (Secure, Path, Domain) are not.

Cookie & Session Decoder

Parse a Cookie header into name/value pairs and decode the session blobs inside it.

live · client-sideWeb, API & Tokensfree · no sign-up

RAW INPUT

DECODED

Output appears here as you type — decoded on your device.

Input is processed on your device. Nothing you paste is sent anywhere.

What is the Cookie & Session Decoder?

A cookie decoder splits a Cookie or Set-Cookie header into its individual name/value pairs and attributes, URL-decoding the values and unwrapping encoded session payloads so you can read what a browser is actually storing.

Cookies (RFC 6265) arrive as one long semicolon-separated header, and their values are frequently percent-encoded, Base64-encoded, or both — a signed session cookie from Flask, Express or Rails is often a Base64 payload with a signature appended. Reading one by eye is unpleasant; splitting it into a table makes the structure obvious immediately.

The attributes on a Set-Cookie header are where security lives. Secure restricts the cookie to HTTPS, HttpOnly hides it from JavaScript (blunting XSS theft), SameSite controls cross-site sending (the CSRF defence), and Domain/Path/Max-Age define its reach and lifetime. Seeing those laid out is the fastest way to audit a session cookie.

Cookie & Session Decoder at a glance

Specification: RFC 6265 (HTTP State Management)
Request header: Cookie: name=value; name2=value2
Security flags: Secure, HttpOnly, SameSite=Lax/Strict/None
Size limit: ≈4 KB per cookie in most browsers

How to use the Cookie & Session Decoder

1Copy a Cookie or Set-Cookie header from your browser's network tab or a server log.
2Paste it in to see each name, value and attribute broken out.
3Decode any Base64-looking session value further with the Base64 or JWT decoder.

When you would reach for it

Auditing whether session cookies carry Secure, HttpOnly and SameSite.
Finding out what a framework packed into its signed session cookie.
Debugging a login loop caused by a cookie scoped to the wrong domain or path.

Cookie & Session Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools