Cookie Decoder: Parse Cookie Headers into Name/Value Pairs

A cookie decoder splits a Cookie header string at each ;, separates every cookie's name from its value, and URL-decodes the value, so a long header becomes a readable list.

Example

Input

session=eyJ1c2VyIjoiYWRhIn0%3D; theme=dark; lang=en-GB

Output

session = eyJ1c2VyIjoiYWRhIn0=
theme = dark
lang = en-GB

%3D was decoded to =. The session value is Base64. Paste eyJ1c2VyIjoiYWRhIn0= into the Base64 decoder and it reads {"user":"ada"}.

Browsers send cookies to a server in one Cookie request header, with pairs separated by ; . Servers set cookies with one Set-Cookie response header per cookie, and those carry attributes after the value:

Attribute	What it does
`Expires` / `Max-Age`	When the cookie is deleted. Without either, it's a session cookie
`Domain` / `Path`	Which URLs the browser sends it to
`Secure`	Only sent over HTTPS
`HttpOnly`	Hidden from JavaScript (`document.cookie`), which protects it from XSS
`SameSite`	`Strict`, `Lax` or `None`. Controls cross-site sending and CSRF exposure

This tool parses the Cookie request format. If you paste a Set-Cookie line, the attributes appear as extra name/value entries.

Recognising session values

Once a value is URL-decoded, its shape usually tells you what it is:

Starts with eyJ and has two dots: a JWT. Use the JWT decoder.
Starts with eyJ without dots: Base64 JSON, common in Flask sessions (often signed and sometimes zlib-compressed) and consent cookies.
s%3A… or s:…: an Express signed cookie (cookie-parser). The part before the dot is the value.
Long random hex or Base64 with no structure: an opaque session ID that only the server can resolve.
GA1.2.… (_ga): a Google Analytics client ID.

Copy the Cookie header from your browser's dev tools (Network tab, request headers) or from a log.
Paste it and read each cookie on its own line, with values URL-decoded.
Copy any encoded value into the matching decoder to look inside.

Parse cookies in code

JavaScript

const header = "session=eyJ1c2VyIjoiYWRhIn0%3D; theme=dark; lang=en-GB";
const cookies = Object.fromEntries(
  header.split(/;\s*/).map((p) => {
    const i = p.indexOf("=");
    return [p.slice(0, i), decodeURIComponent(p.slice(i + 1))];
  })
);
console.log(cookies);

Python

from http.cookies import SimpleCookie
from urllib.parse import unquote

c = SimpleCookie()
c.load("session=eyJ1c2VyIjoiYWRhIn0%3D; theme=dark; lang=en-GB")
print({k: unquote(m.value) for k, m in c.items()})

Cookies at a glance

Specification	RFC 6265 (HTTP State Management)
Request header	`Cookie: a=1; b=2`
Response header	One `Set-Cookie` per cookie, with attributes
Size limit	About 4 KB per cookie in most browsers

Frequently asked questions

Can I decode an encrypted session cookie?

No. Frameworks such as Rails and Laravel encrypt session cookies with a server-side key, so the value is unreadable without it. Signed-but-not-encrypted cookies (Flask, Express) can be decoded, but not modified without breaking the signature.

Why is my cookie value full of %XX?

Cookie values can't contain spaces, commas, semicolons or quotes, so many frameworks URL-encode them. This tool decodes them automatically.

Is it safe to share my Cookie header?

Not a real one. Session cookies are credentials: anyone with the value can act as you until the session ends. Redact session values before sharing logs or screenshots.

Last reviewed 23 October 2026 · found a mistake? contact@decoder.tools · view as markdown