Cookie policy inspection
Review supplied Set-Cookie declarations locally, including Secure, HttpOnly, SameSite, Partitioned and prefix requirements without reading the browser cookie store.
Review Set-Cookie declarations locally
Paste one or more Set-Cookie: name=value; attributes lines from an application you own or are authorised to inspect. The browser cookie store is not read, and this page does not upload cookie names or values.
This is a bounded structural review. It cannot prove that a browser stored, sent, partitioned, evicted or rejected a cookie in a particular request context.
Limit: 32 KiB, 64 Set-Cookie lines, 24 attributes per line. Unknown attributes produce partial evidence. Values stay in this page and are never copied into the report.
Limits of this review
Cookie behavior depends on the request host, top-level site, request method, navigation context, browser defaults, privacy controls and storage state. Domain matching, public-suffix checks, expiry clocks, eviction, third-party restrictions and partition keys are not reproduced here.
document.cookie cannot show HttpOnly cookies or reconstruct Set-Cookie attributes, so this tool intentionally does not use it as an audit source. SameSite=None, prefixes and Partitioned declarations receive structural warnings, but actual acceptance needs browser testing in the intended context.