Session Cookie Security Checker

Paste a Set-Cookie header and see HttpOnly, Secure, and SameSite checked - each missing flag mapped to the specific attack it enables, not a generic warning.

Paste a Set-Cookie header

HttpOnly

JavaScript cannot read this cookie.

Secure

Can be sent over plain HTTP - readable by anyone on the network path (public wifi, a compromised router).

SameSite=lax

Sent on top-level navigation but not on cross-site subrequests - reasonable default, some CSRF protection.

Was this tool helpful?

See this same kind of analysis applied to your whole repository

Call graphs, dead code, blast radius, and a health score. Results in 60 seconds, free.

Analyze a repository

Related tools

See all Security tools →

CORS Config Generator/Explainer

Origins, methods, headers to generated CORS headers.

JWT Inspector

Decode a JWT header and payload, check expiry - decode-only, signing key never needed.

Bcrypt Cost Factor Calculator

A measured benchmark on your hardware plus a target hash time to the right bcrypt cost factor.

AWS IAM Policy Generator

Service, access level, and a resource ARN to a valid, scoped IAM policy JSON.

API Key Format Identifier

Paste a key prefix - which service it belongs to, based on documented prefix conventions.

Runs entirely in your browser. Nothing is stored. Free forever.