Web Tools tools.bryantsmith.com

Creative Workflow Helpers

Cookie Builder & Inspector

Build a ready-to-ship Set-Cookie header from a few options, or paste an existing Set-Cookie/Cookie header to see exactly what every attribute does. Nothing leaves your browser.

Runs in your browser v1.0.0

1. Start from a common cookie

optional

Pick a starting point, then tweak any field below. The header updates as you type.

2. Cookie details

Expiry

3600 = 1 hour, 86400 = 1 day, 2592000 = 30 days. 0 deletes.

Converted to a GMT date in the header.

Scope & security

Usually / for the whole site.

Blank makes it a host-only cookie.

Advanced optional

Set-Cookie header

live 


                        

                        

                            
                            
                            
                            
                        

                        

                        

                    

                

            

        

    


    

    

        
            Cookie attribute cheat sheet
            reference
        
        

            

                

                    
Expires

                    
Absolute GMT date when the browser deletes the cookie. Sent as an HTTP date.

                

                

                    
Max-Age

                    
Lifetime in seconds. 0 or a negative value deletes the cookie; it wins over Expires.

                

                

                    
Domain

                    
Which hosts can receive the cookie. Omit it for a host-only cookie. Modern browsers ignore a leading dot.

                

                

                    
Path

                    
URL path prefix the cookie applies to. / covers the whole site.

                

                

                    
Secure

                    
Only send the cookie over HTTPS. Required by browsers when SameSite=None.

                

                

                    
HttpOnly

                    
Keeps the cookie out of document.cookie, reducing the impact of cross-site scripting.

                

                

                    
SameSite

                    
Strict never sends it cross-site, Lax sends it on top-level navigations, None always sends it (needs Secure).

                

            

        

    


    

        

            
How it works

        

        

            

                Everything runs locally with plain JavaScript. The builder assembles a single
                Set-Cookie value in the recommended attribute order and validates the
                cookie name, value and expiry as you type. The inspector splits a header into its
                name, value and attributes and explains each one, flagging problems such as
                SameSite=None without Secure. Use Ctrl/Cmd
                + Enter to copy the active result. No cookie is ever set and no input is
                sent to a server.
            

        

    




Related tools
  • CORS Header Builder & ExplainerModel a cross-origin request and get the exact CORS response headers to send, explained in plain language.
  • MIME Type InspectorLook up or infer MIME types from a filename, extension, or Content-Type header — with a structured breakdown.
  • Permissions Policy BuilderBuild, validate and explain a Permissions-Policy header for browser features — entirely in your browser.
  • Unicode Character InspectorInspect any character as grapheme clusters, code points, Unicode names, categories and UTF-8/UTF-16 encodings — entirely in your browser.
  • .env Compare & MergeCompare development, staging, and production .env key sets without exposing secret values, then build a merged template.
  • Accessible Name CalculatorPaste HTML, pick an element, and see the accessible name assistive technology computes — entirely in your browser.
More Creative Workflow Helpers tools