Cookie Scanner / Analyzer

The Cookie Scanner / Analyzer is a free online tool that paste set-cookie headers or document.cookie to analyze attributes, security flags, categories, gdpr compliance, and generate consent banner templates.. It runs entirely in your browser with no installation or sign-up needed.

Set-Cookie headers (one per line) or raw document.cookie strings. Auto-detects format.

Name-based heuristics for 30+ patterns: _ga/_gid → Analytics, _fbp → Marketing, __cf/csrf/session → Necessary, pref/lang → Preferences.

No. All parsing and analysis runs in your browser.

Yes, the Cookie Scanner / Analyzer is 100% free with no registration, no hidden fees, and no usage limits. All processing happens locally in your browser, ensuring complete privacy.

Yes, the Cookie Scanner / Analyzer is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the Cookie Scanner / Analyzer in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The Cookie Scanner / Analyzer works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

Because the browser deliberately hides them. The document.cookie property in JavaScript only exposes the name=value pairs your scripts are allowed to read; it never reveals attributes like HttpOnly, Secure, SameSite, Domain, Path, or Expires. HttpOnly cookies, the ones holding session tokens, are excluded from document.cookie entirely by design, so a string copied from the console can't show their security flags. That is why this scanner shows names and values only when it detects a document.cookie input, and gives every cookie a partial picture rather than a full security grade. To audit flags properly, grab the raw Set-Cookie response headers from your browser's Network tab (under Response Headers) or a curl -I request, then paste those instead for a complete attribute and security breakdown.

Each cookie starts at 100 and loses points for missing protections. A missing Secure flag costs 30 points, since the cookie can travel over unencrypted HTTP. A missing HttpOnly flag also costs 30, because JavaScript can then read it and any XSS bug becomes session theft. A missing SameSite attribute costs 25 points for leaving the cookie open to CSRF. SameSite=Lax loses a small 5 points; SameSite=None loses 10, or 15 if it lacks the required Secure flag; SameSite=Strict scores cleanest with no deduction. The Partitioned (CHIPS) attribute adds a small 5-point bonus. Per-cookie scores are then averaged into an A–F grade. Paste your Set-Cookie headers to see exactly which flags are dragging each cookie's score down.

SameSite=None means the cookie is deliberately sent on cross-site requests, which is necessary for legitimate cases like embedded widgets, SSO, or third-party iframes. The scanner still flags it because cross-site cookies carry more risk and browsers enforce a strict rule: SameSite=None only works if the Secure flag is also present, and modern browsers reject None cookies without it. So the tool deducts 10 points for None with Secure, and a steeper 15 points plus a warning when Secure is missing, since that cookie will simply be dropped. The flag isn't saying you're wrong, only that this cookie needs extra scrutiny and a valid Secure pairing. If a cookie can be same-site, prefer Lax or Strict. Paste your headers to confirm your None cookies carry Secure.

A session cookie has no expiry date, so the browser deletes it when the user closes the browser; a persistent cookie carries an Expires date or Max-Age and survives until that time elapses. The scanner reads both attributes, marks each cookie Session or Persistent, and for persistent ones calculates the days until expiry from Max-Age or the Expires timestamp. This matters for both security and privacy: short-lived session cookies limit exposure if a token leaks, while long-lived persistent cookies, especially analytics and marketing ones, draw extra GDPR scrutiny because lengthy retention must be proportional to purpose. The tool also notes that persistent cookies should have reasonable expiry periods. Paste your Set-Cookie headers to see which cookies linger and for how long.

Under GDPR and the ePrivacy Directive, only strictly necessary cookies are exempt from consent. The scanner sorts every cookie into Necessary, Analytics, Marketing, Preferences, or Unknown using over 30 name patterns, then attaches the consent obligation. Necessary cookies, like session, CSRF, and authentication tokens, can be set without consent but still belong in your privacy policy. Analytics cookies such as _ga and _gid, and marketing cookies such as _fbp or _gcl_au, require explicit, prior opt-in and must not be set until the user agrees. Preferences cookies usually need consent unless they directly serve a user-requested function like language. Anything Unknown should be reviewed and treated as non-essential. Paste your cookies to see the per-category consent guidance and generate a matching consent banner.