Third-Party Cookie & Partitioned Storage Auditor
Inspect cookie attributes, detect third-party risks, and evaluate partitioned storage patterns without sending cookie data to a server.
Auditor
Results
Parsed cookies
Introduction
Third-party cookies are increasingly restricted by browsers. At the same time, embedded workflows still need state management. Partitioned cookies, such as CHIPS, provide a more privacy-preserving pattern for some cross-site use cases.
This auditor helps you review cookie attributes and identify patterns that may cause privacy, compatibility, or deployment problems.
How it works
The tool parses cookie definitions you paste. It then compares cookie domains against the top-level site context and audits attributes such as Secure, HttpOnly, SameSite, and Partitioned.
- No cookie data leaves your browser.
- HttpOnly cookies cannot be read from JavaScript, so you paste them manually.
- Third-party detection is approximate and depends on the URLs you provide.
- Findings are advisory, not a browser enforcement simulation.
How to use
- Enter the top-level site URL.
- Optionally enter the cookie source URL.
- Paste Set-Cookie lines, Cookie header lines, or JSON cookie objects.
- Run the audit.
- Review findings and copy the guidance or report.
Practical example
A third-party analytics cookie with SameSite=None must also be
Secure. If it is used in an embedded context, a
Partitioned attribute may be appropriate where supported.
Use cases
- Auditing cookie headers before migration.
- Preparing for third-party cookie deprecation.
- Reviewing CHIPS-style partitioned cookies.
- Checking session cookie hygiene.
- Documenting privacy risks for internal review.
Best practices
- Use first-party cookies where possible.
- Set SameSite explicitly.
- Use Secure for all networked cookies.
- Use HttpOnly for authentication cookies.
- Limit cookie lifetime and scope.
Common mistakes
- Using SameSite=None without Secure.
- Assuming Domain cookies are always first-party.
- Using overly broad cookie domains.
- Forgetting embedded third-party contexts.
- Keeping long-lived tracking cookies unnecessarily.
Limitations
- The tool cannot inspect live browser cookie jars directly.
- HttpOnly cookies must be pasted manually.
- Domain comparison is approximate without a public suffix database.
- Browser privacy policies vary and continue to change.
Browser compatibility
Cookie attribute support varies by browser. Secure, HttpOnly, and SameSite are widely supported. Partitioned cookie support is emerging and should be tested carefully.
FAQ
Is my cookie data uploaded?
No. All parsing and analysis happen locally in your browser.
Can it read cookies from my browser automatically?
No. JavaScript cannot read HttpOnly cookies or other sites’ cookies. You must paste the cookie data you want to audit.
What does Partitioned mean?
Partitioned cookies separate storage by top-level site, reducing cross-site tracking while allowing some embedded functionality.
Does a pass guarantee compliance?
No. It indicates that common technical issues were not detected. Legal, privacy, and consent requirements still need separate review.