Set-Cookie Header Explainer & Cookie Checker
Paste Set-Cookie headers (or a Cookie request header) to see what each attribute does, whether the browser will accept it, and when it gets sent back.
Would the browser send it?
Pick the page you are on and where the request goes. Tooltern applies the browser's domain, path, Secure, expiry and SameSite rules to every cookie above.
How it works
Paste one or more Set-Cookie response headers, one per line, as they appear in your browser's network panel or in curl -I output. The Set-Cookie: prefix is optional. Tell the tool which URL sent the response, because the browser's rules depend on it: a cookie set from /account/login without a Path only comes back under /account, and a page on http:// cannot set a Secure cookie.
Each cookie gets a verdict (Accepted, Rejected or Deletes cookie), a plain-words line for every attribute, and warnings for the usual mistakes: SameSite=None without Secure, a Domain the host is not allowed to set, broken __Host- and __Secure- prefixes, a session-looking cookie without HttpOnly, unreadable Expires dates, lifetimes over Chrome's 400-day cap and cookies over 4,096 bytes.
Would the browser send it? applies domain matching, path matching, Secure and SameSite to every cookie for a request you describe: the page you are on, where the request goes, and whether it is a link, a form POST or a background fetch, image or iframe. Sites are compared the way browsers do (registrable domain plus scheme), using a built-in sample of public suffixes; the full list is used by Anvil's link X-ray API. Need the same checks in a script or CI job? Anvil's free Set-Cookie checker API returns the verdict and every reason as JSON, no key needed.
Paste a Cookie: request header instead and the tool lists the name/value pairs and flags duplicate names, the classic sign of two cookies with different paths. For a visual tour of cookie jars and trackers, try Wirebook's What is a cookie on a website? lesson.
Questions
Why is my cookie not being set?
The usual causes are SameSite=None without Secure, setting a Secure cookie from an http:// page, a Domain that is not the current host or a parent of it, or a cross-site fetch that did not use credentials: 'include'. Paste the header and the tool names the rule.
What does SameSite=Lax mean?
The cookie is sent on same-site requests and when someone follows a normal link to your site from elsewhere, but not with cross-site forms, images, iframes or fetch calls. Chrome and Edge use Lax when SameSite is missing.
Max-Age or Expires: which wins?
Max-Age. If both are present, browsers use Max-Age and ignore Expires. Max-Age=0 (or an Expires date in the past) deletes the cookie.
Is my header uploaded?
No. Parsing and the sending simulation run entirely in your browser, and nothing is stored.
What is a __Host- cookie?
A name prefix the browser enforces: the cookie must be Secure, set from HTTPS, have Path=/ and no Domain. That pins it to exactly one host, so a subdomain cannot overwrite it.