Set-Cookie static diagnosis

How to use

1. Enter the header and both URLs

   Paste one Set-Cookie line, the URL that issued the cookie, and the URL of the request that should carry it.

2. State the site relation and navigation

   Choose same-site or cross-site, the method, and whether it is a top-level navigation. Leave it unknown when you cannot tell.

3. Read blocking and unevaluated apart

   Blocking conditions prevent storage or sending. Unevaluated ones are outside this diagnosis. Notes add context without changing the verdict.

Scope of the result

Set-Cookie must be a single line of 16,384 characters or fewer, and only HTTP(S) URLs are accepted; neither URL is ever requested. There is no Public Suffix List, so whether a Domain is a public suffix is not decided. Conflicts with stored cookies, third-party cookie policy, per-site permissions, credentials and CORS as a whole, cookie age, browser-specific SameSite grace periods and full CHIPS behaviour are out of scope.

Frequently asked questions

Does it request the URLs I enter?

No. It only inspects the URL structure and the Set-Cookie attributes, and it never reads or writes cookies.

Does "sendable under the stated conditions" guarantee delivery?

No. Browser settings, third-party cookie policy, stored cookies, CORS and credentials are not evaluated. Confirm real traffic in developer tools.

Why is the site relation not detected automatically?

This tool ships no Public Suffix List, so you state the relation. Choose unknown when you cannot tell.

Does the cookie value appear in the result?

The value itself is never shown, only its byte count. The cookie name, URLs and attributes may still carry identifying information.

Can it compute the remaining lifetime of a stored cookie?

No. Expiry is computed as if the cookie were received right now, so real receipt times and elapsed age are not modelled.