Cookie Checker

No, and nothing on the web can be. A page is only allowed to read cookies belonging to its own address — that restriction is the whole reason cookies are safe, since otherwise any site could read your bank's. To view cookies your browser already holds you need its own settings or developer tools, or an extension you have granted that permission. This is a cookie viewer for what a site sends back, which is a different question and the one you can answer from here.

Because it asks for one page, once, as a visitor who has never been there. Plenty of cookies are set later — by JavaScript after the page loads, by a third-party script, or only once somebody accepts a consent banner. None of those appear in a first response. Treat what you see here as the cookies a site sets before you have agreed to anything, which is the interesting number for a privacy review, not the total.

Ask it for a page and read what it sends back, which is what this does — enter an address to check cookies on website pages you do not control, and you get every cookie in that first response with its domain, expiry and flags. It is the same thing a browser does before rendering anything, minus the rendering. What it will not show you is anything set later by JavaScript or after a consent banner, so treat it as what a site sets before you have agreed to anything rather than the full list.

Secure stops the cookie being sent over plain HTTP, so it cannot be read by anyone watching the connection. HttpOnly hides it from JavaScript, so a cross-site scripting bug cannot steal it — this is the one that matters most for a login cookie. SameSite controls whether the cookie rides along on requests started by other sites: Strict never, Lax only for ordinary link clicks, None always, which then requires Secure. Missing SameSite is treated as Lax by current browsers, but stating it is better than relying on a default that has changed before.

No. A cookie that JavaScript is meant to read — a theme preference, a dismissed banner, a locale — has to be readable by JavaScript, so HttpOnly would break it. The flag matters for anything that identifies you: a session id, a login token, a cart tied to an account. This tool says which flags are missing and what each one protects against; whether that matters depends on what the cookie is for, and only the site knows that.

It sees one ordinary page request from our server, not from you. Your address is not passed on and no cookie is stored, sent or reused — the response is read once and thrown away. If you paste a Set-Cookie header instead of an address, nothing is fetched at all and the whole check happens without leaving this page.

Anything that is not an ordinary public web address: local names like localhost, addresses on private networks, and anything that is not http or https. A tool that fetches whatever it is given can be pointed at machines only our server can reach, so this refuses those outright and says so, including when a redirect tries to lead it somewhere private.

That is your browser's job, not a page's — no site can clear another site's cookies. In Chrome and Edge it is Settings, Privacy and security, Third-party cookies, then See all site data and permissions; in Firefox, Settings, Privacy and Security, Cookies and Site Data, Manage Data; in Safari, Settings, Privacy, Manage Website Data. All of them let you remove one site rather than everything, which is usually what you want — clearing the lot signs you out everywhere.