Cookie String Parser & Editor – Read document.cookie

A cookie string is the format returned by document.cookie in JavaScript. It consists of semicolon-separated name=value pairs, such as session_id=abc123; theme=dark; lang=en. Each pair represents a single cookie. Values are typically URL-encoded (e.g., spaces become %20). This format differs from the Set-Cookie HTTP header, which includes additional attributes like Domain, Path, Expires, Secure, HttpOnly, and SameSite.

Cookie values are URL-encoded because they cannot contain certain special characters like semicolons (;), commas (,), spaces, or equals signs (=) in their raw form. These characters have special meaning in the cookie format. URL encoding (using encodeURIComponent()) converts these characters into safe percent-encoded representations (e.g., space → %20, semicolon → %3B). This tool automatically decodes values for readability and re-encodes them in the output.

According to RFC 6265, browsers must support cookies with a minimum size of 4,096 bytes (4 KB) per cookie (including the name, value, and attributes). Additionally, browsers typically allow 50–180 cookies per domain and 3,000+ cookies total across all domains. If you exceed these limits, older cookies may be silently evicted. For best practices, keep individual cookies small (under 1 KB) and minimize the total number of cookies per domain.

document.cookie is a JavaScript API that returns all accessible cookies for the current domain as a single string of name=value pairs separated by ; . It only shows the names and values — no metadata like expiration, path, or security flags.

Set-Cookie is an HTTP response header used by servers to create or update cookies. It includes the name and value plus optional attributes: Domain, Path, Expires or Max-Age, Secure, HttpOnly, and SameSite. HttpOnly cookies (marked with the HttpOnly flag) are not accessible via document.cookie, which is a security feature to prevent XSS attacks from stealing session tokens.

To delete a cookie via JavaScript, set its Expires attribute to a date in the past. For example:
document.cookie = "cookieName=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/";

Important: you must match the path and domain attributes that were used when the cookie was created, otherwise the deletion won't work. For cookies set with Secure flag, you must be on an HTTPS page to delete them. Note that HttpOnly cookies cannot be deleted via JavaScript — they must be removed server-side.

SameSite is a cookie attribute that controls when cookies are sent with cross-site requests, providing protection against CSRF (Cross-Site Request Forgery) attacks. It has three possible values:

• Strict — Cookie is only sent in first-party contexts (same site). Not sent for any cross-site requests.
• Lax (default in modern browsers) — Cookie is sent with top-level navigations (e.g., clicking a link) but not with cross-site subresource requests like images or iframes.
• None — Cookie is sent with all requests, both first-party and cross-site. Requires the Secure flag (HTTPS only).

document.cookie may return an empty string for several reasons:

1. No cookies set — The current domain simply has no cookies stored.
2. All cookies are HttpOnly — Cookies marked with the HttpOnly flag are invisible to JavaScript for security reasons. This is common for session tokens.
3. File:// protocol — When opening HTML files locally, some browsers don't support cookies on the file:// protocol.
4. Third-party context — If the page is loaded in an iframe from a different domain, cookie access may be restricted due to SameSite policies or third-party cookie blocking.
5. Browser privacy settings — Some browsers block all cookies in private/incognito mode or when strict privacy settings are enabled.