Inspect cookie security attributes

With Cookie inspector, web developers and site testers can check a page or request before publishing. Read the Secure, HttpOnly and SameSite attributes of the cookies a page sets.

Read the Secure, HttpOnly and SameSite attributes of the cookies a page sets. Use it free in your browser with no account required.

How to use

Enter the address of the page whose cookies you want to inspect.
Start the test so the tool can query the target page.
Read the list of observed cookies and note their names and values.
Review the Secure, HttpOnly and SameSite attributes of each cookie shown.
Flag settings that do not match your security policy.

Example

A web team checks a page after a redesign and wants to know which cookies are returned on the first load. They enter the page address, run the inspection and review each cookie attribute. A session cookie missing suitable protection can be spotted before release and reported to the responsible team.

Limits and formats

The tool shows cookies received from the request, not those added later by JavaScript.
It does not modify or delete cookies on the inspected page.
Results depend on the headers returned at the time of the test.
Some cookies may be set by third-party resources that are not visible in this first result.
Inspect only pages you are allowed to test.

Where processing happens

The page address to inspect is sent to the YOORfree server. That server queries the target page itself and returns the attributes of the cookies observed. No file is uploaded from your device. The check reflects the response received at that moment. Cookies created after this first exchange may not appear.

Frequently asked questions

Why do some cookies visible in my browser not appear?

The tool reads cookies returned by the response to the tested request. Cookies created later by JavaScript, an iframe or another request may not be part of that first result.

What do Secure, HttpOnly and SameSite mean?

Secure restricts the cookie to encrypted connections. HttpOnly prevents page scripts from accessing it. SameSite controls whether it is sent with requests coming from another site. These attributes improve protection against some attacks.

Can I use the tool to change a cookie?

No, it only observes and displays the attributes of the cookies received. To change a cookie during your tests, use your browser developer tools or your application configuration.