Cookie Header Parser
Parse a client Cookie request header into named values, detect duplicates, decode percent escapes, and export JSON
Parsed cookie JSON will appear here.
About this tool
Cookie Header Parser reads the client request form Cookie: name=value; name2=value2 and converts each pair into a table and JSON object. It accepts an optional Cookie: prefix, splits semicolon-delimited pairs while respecting quoted values, preserves equals signs inside values, optionally decodes percent escapes, warns about malformed segments, and flags duplicate cookie names. Because a JSON object cannot retain duplicate keys, the table and warning list should be reviewed before using the object output. This tool intentionally does not parse Set-Cookie response attributes such as Path, Domain, Expires, Secure, HttpOnly, or SameSite; use the dedicated Set-Cookie parser for that protocol direction. Cookie values can contain credentials and session identifiers, so avoid sharing live production headers even though processing is local.
Scenario Recipes
Compare browser request cookies with an API gateway log
Goal: Find missing or duplicate names without exposing a live session
- Replace credential-bearing values with placeholders while preserving names, delimiters, and duplicate order.
- Parse the sanitized header and review malformed-segment, percent-decoding, and duplicate-name warnings.
- Compare the ordered table with the gateway capture, then investigate cookie scope and browser policy in approved tooling.
Result: A protocol-direction-correct cookie comparison that does not confuse request pairs with Set-Cookie attributes.
Frequently Asked Questions
What Cookie syntax does it parse?
It parses the client request header form name=value pairs separated by semicolons.
Is this the same as Set-Cookie parsing?
No. Set-Cookie is a response header with attributes and different grammar.
How are duplicate names handled?
All pairs remain in the table, a warning is shown, and the JSON object keeps the final value.
Are equals signs allowed inside values?
Yes. Only the first equals sign separates the name, so Base64-like values remain intact.
Should percent decoding always be enabled?
No. Cookie value encoding is application-specific; disable decoding when literal percent sequences must be preserved.
Is the header uploaded?
No. Parsing, decoding, copying, and JSON download happen locally.
Keep browsing