Cookie Security Analyzer

Check your cookies for the right flags

A cookie is only as safe as its flags, and missing ones expose sessions to theft and misuse. This analyser checks cookies for the security attributes that matter, Secure, HttpOnly, SameSite, so you can confirm your own cookies are set safely.

What the flags protect against

Each cookie flag closes a specific hole. Secure stops the cookie being sent over unencrypted HTTP where it could be intercepted. HttpOnly stops scripts reading it, which defends the session against cross-site scripting theft. SameSite limits when the cookie is sent cross-site, defending against cross-site request forgery. A session cookie missing these is a common and serious weakness, because the session token it carries is exactly what an attacker wants. Checking the flags confirms your cookies are hardened.

Harden your sessions

The tool runs entirely in your browser, so nothing you paste is uploaded, which is exactly what you want when the input is your own security-sensitive data.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.