# Cookie & Session Decoder

> Split a Cookie header into name/value pairs and URL-decode each value.

- Page: https://decoder.tools/cookie-decoder
- Category: Web, API & Tokens
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A cookie decoder splits a `Cookie` header string at each `;`, separates every cookie's name from its value, and URL-decodes the value, so a long header becomes a readable list.

## Example

```text Input
session=eyJ1c2VyIjoiYWRhIn0%3D; theme=dark; lang=en-GB
```

```text Output
session = eyJ1c2VyIjoiYWRhIn0=
theme = dark
lang = en-GB
```

`%3D` was decoded to `=`. The `session` value is Base64. Paste `eyJ1c2VyIjoiYWRhIn0=` into the [Base64 decoder](/base64-decoder) and it reads `{"user":"ada"}`.

## Cookie and Set-Cookie headers

Browsers send cookies to a server in one `Cookie` request header, with pairs separated by `; `. Servers set cookies with one `Set-Cookie` response header per cookie, and those carry attributes after the value:

| Attribute | What it does |
|---|---|
| `Expires` / `Max-Age` | When the cookie is deleted. Without either, it's a session cookie |
| `Domain` / `Path` | Which URLs the browser sends it to |
| `Secure` | Only sent over HTTPS |
| `HttpOnly` | Hidden from JavaScript (`document.cookie`), which protects it from XSS |
| `SameSite` | `Strict`, `Lax` or `None`. Controls cross-site sending and CSRF exposure |

This tool parses the `Cookie` request format. If you paste a `Set-Cookie` line, the attributes appear as extra name/value entries.

## Recognising session values

Once a value is URL-decoded, its shape usually tells you what it is:

- Starts with `eyJ` and has two dots: a **JWT**. Use the [JWT decoder](/jwt-decoder).
- Starts with `eyJ` without dots: **Base64 JSON**, common in Flask sessions (often signed and sometimes zlib-compressed) and consent cookies.
- `s%3A…` or `s:…`: an **Express signed cookie** (`cookie-parser`). The part before the dot is the value.
- Long random hex or Base64 with no structure: an **opaque session ID** that only the server can resolve.
- `GA1.2.…` (`_ga`): a Google Analytics client ID.

## How to use the cookie decoder

1. Copy the `Cookie` header from your browser's dev tools (Network tab, request headers) or from a log.
2. Paste it and read each cookie on its own line, with values URL-decoded.
3. Copy any encoded value into the matching decoder to look inside.

## Parse cookies in code

```js JavaScript
const header = "session=eyJ1c2VyIjoiYWRhIn0%3D; theme=dark; lang=en-GB";
const cookies = Object.fromEntries(
  header.split(/;\s*/).map((p) => {
    const i = p.indexOf("=");
    return [p.slice(0, i), decodeURIComponent(p.slice(i + 1))];
  })
);
console.log(cookies);
```

```python Python
from http.cookies import SimpleCookie
from urllib.parse import unquote

c = SimpleCookie()
c.load("session=eyJ1c2VyIjoiYWRhIn0%3D; theme=dark; lang=en-GB")
print({k: unquote(m.value) for k, m in c.items()})
```

## Cookies at a glance

| | |
|---|---|
| Specification | RFC 6265 (HTTP State Management) |
| Request header | `Cookie: a=1; b=2` |
| Response header | One `Set-Cookie` per cookie, with attributes |
| Size limit | About 4 KB per cookie in most browsers |

## FAQ

### Can I decode an encrypted session cookie?

No. Frameworks such as Rails and Laravel encrypt session cookies with a server-side key, so the value is unreadable without it. Signed-but-not-encrypted cookies (Flask, Express) can be decoded, but not modified without breaking the signature.

### Why is my cookie value full of %XX?

Cookie values can't contain spaces, commas, semicolons or quotes, so many frameworks URL-encode them. This tool decodes them automatically.

### Is it safe to share my Cookie header?

Not a real one. Session cookies are credentials: anyone with the value can act as you until the session ends. Redact session values before sharing logs or screenshots.