PII Detector
Scan text for emails, phones, and card-like patterns locally.
OpenAudit cookie flags and lifetimes from a cookie jar or Set-Cookie headers, with values left out of the report.
Use a Netscape jar, Set-Cookie lines, or both.
Missing flags, long lifetimes and tracking names are listed.
The JSON omits cookie values by design.
Update your app headers and paste the new ones.
A penetration test report says your session cookie is missing a flag, and you want to see every cookie the app sets before you fix just the one. You have a curl cookie jar and some response headers copied from devtools. Cookie Jar Lab reads both.
Paste lines in either format. Netscape cookie jar lines are tab-separated with seven fields (domain, subdomain flag, path, secure, expiry, name, value). Set-Cookie lines can start with Set-Cookie: or be a bare name=value; attribute list. The report lists each cookie's name, domain, path, Secure, HttpOnly and SameSite values, its source format and any risks. Risks flagged are: an auth-like name (containing session, auth, token or sid) without Secure; a session or auth cookie set without HttpOnly; Max-Age over 30 days; an expiry more than a year away; names that look like analytics or tracking, such as _ga or utm_; and Set-Cookie lines with no SameSite.
Cookie values are deliberately left out of the report so you can share it. Two format quirks are worth knowing. Lines starting with # are skipped as comments, and curl writes HttpOnly cookies as #HttpOnly_ lines, so remove that prefix if you want them analyzed. HttpOnly and SameSite cannot be expressed in Netscape format, so only Set-Cookie input is checked for them.
After fixing cookies, review the rest of your response headers with the security headers generator, and check cross-origin rules with the CORS generator. Analysis runs in your browser; session cookies are credentials, so paste them only into tools that keep them local.
Keyboard shortcut
Answers for this tool. For site-wide help, open the FAQ hub.
curl marks HttpOnly cookies by starting the line with #HttpOnly_, and the tool skips every line that begins with #. Delete the #HttpOnly_ prefix from those lines to include them.
Only partly. A Cookie header holds several name=value pairs separated by semicolons, but the parser treats the first pair as the cookie and the rest as attributes. Put each cookie on its own line instead.
Not necessarily. The checks cover security attributes and a few naming patterns. Consent requirements depend on what the cookie does and where your users are, so involve whoever owns privacy compliance.