ClientSideTools Privacy-First Browser Tools

Cookie Audit (SameSite / Secure / Size / Expiry)

Misconfigured cookies silently break auth flows and get dropped by browsers. Paste your Set-Cookie headers and this tool flags SameSite, Secure, HttpOnly, size, and expiry problems — plus per-domain budget totals.

PWA & Browser Storage Local processing Headers are parsed locally. Nothing is uploaded or sent.

Tool interface

Introduction

Cookies are deceptively easy to misconfigure. A missing Secure flag, an invalid SameSite, or an oversized value can silently break login flows or cause browsers to drop the cookie entirely. This audit surfaces all of it before production.

How it works

  • Parses each Set-Cookie line into name, value, and attributes.
  • Validates SameSite, Secure, HttpOnly, size, and expiry semantics.
  • Aggregates per-domain cookie count and byte totals.
  • Optionally captures live document.cookie (non-HttpOnly only).

Privacy

All parsing is local string processing. Cookie values are never sent anywhere. No account, no API key.

Limitations

  • HttpOnly cookies are invisible to JavaScript capture.
  • Live-captured cookies lack attribute metadata.
  • Browser limits vary; thresholds are conservative common values.

FAQ

What does SameSite=Lax mean?

The cookie is sent with top-level navigations and GET requests, but not with cross-site POSTs or subresource loads. It's the modern default.

Are my cookie values uploaded?

No. Everything is parsed locally in your browser.

Related tools

Version and changelog

  • Version: 1.0.0
  • Last updated: August 12, 2026
  • Changelog: Initial production release.