Why are some cookies missing?

Cookies with the HttpOnly flag are not exposed to JavaScript — by design, to defend against XSS. The inspector can only see and edit cookies without HttpOnly.

What about Secure and SameSite flags?

document.cookie does not expose those flags when reading, so the inspector cannot display them. You can set them when creating a cookie if you use a server.

Does deleting here really delete the cookie?

It overwrites the cookie with an expired date, which the browser treats as deletion. Real cookies set by your server will reappear on the next request.

Are cookies sent anywhere?

No. The inspector only reads and writes document.cookie for the current origin in your tab.

document.cookie · live · add · edit · delete

Inspect document cookies

View, add, edit, and delete cookies visible to JavaScript on this origin. HttpOnly cookies remain hidden by design.

Cookies Inspector

Visible

Origin

—

host

Edits

pending

Status

live

1s refresh

input · add cookie

HttpOnly cookies are invisible to JavaScript and will not appear here. Cookies can only be deleted on the path they were set on.

output · 0 cookies

No visible cookies.

Quick Start

How to inspect cookies

The cookies you set in the browser DevTools and the cookies set by document.cookie share the same storage. This tool reflects both.

01
Add a cookie
Type a name, value, path, and TTL. Click Add to commit it.
Inputs are treated as UTF-8 throughout the pipeline and validated client-side as you type — nothing dispatches until the value is well-formed.
addinpututf-8client-sidevalidated
set · textsession_id · set
```
session_id=abc · 7d
```
loaded · parsedclient-side
02
Edit inline
Click a value, change it, hit Save.
Each toggle re-computes through a memoised hook, so flipping options never resets your input and the UI stays snappy on large inputs.
editoptionslivememoisedtoggles
edit · memoisedvalue · live
```
session_id=xyz
```
options set · memoisedlive
03
Delete safely
Del sets an expired date on the current path — same rules as the browser.
Randomness — where used — comes from crypto.getRandomValues, never Math.random. Heavy work sits in useMemo.
deletecomputeinstantlocaldeterministic
del · instantexpired · computed
```
expires=1970
```
computed · instantinstant
04
Live refresh
The list updates every second so DevTools changes appear automatically.
Copy writes through navigator.clipboard and downloads use a Blob — zero network traffic. Same input plus same options always yield the same bytes.
watchcopydownloadzero-networkreproducible
ok · copiedlive · copied
```
1s tick
```
shipped · ready to shipsuccess

Pro tips

Pro tips for everyday utilities

Reach for crypto.getRandomValues

Cryptographically random for IDs, tokens, salts. Math.random is for animation and games, not security.

Sort IDs lexicographically

UUID v4 has no time ordering. Use ULID or UUID v7 if you need sorted IDs.

Mock data with seeds

Faker-style libraries can be seeded so tests are reproducible. Embed the seed in the fixture file.

Reference cards beat memory

Cheatsheets for Vim, Git, Docker, Linux signals are faster than man pages when you’re mid-flow.

Browser APIs vary

Touch events, gamepads, and clipboard differ across vendors. Feature-detect before use.

Persist in the right place

localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data.

Use Cases

When to inspect cookies

Auth debugging, tracker audits, demo seeding.

Auth debugging

Confirm session cookies match your server's expectations. Random values come from crypto.getRandomValues — cryptographically secure for tokens, salts, and session IDs. Math.random is deterministic enough for animations but predictable enough to be a security bug.

CSPRNG-backed

Tracker audits

Spot third-party trackers visible to the page. Pair with hashids, ULID, or UUID v7 when you need both random and sortable — useful for primary keys, public-facing IDs, and event log ordering without a sequence column.

reproducible

Demo seeding

Seed a cookie before walking a stakeholder through a flow. Output is deterministic given the same seed, so fixtures and tests stay reproducible across CI runs and contributor machines. Embed the seed in the fixture file for full replay.

snappy

Migration tests

Mock pre-migration cookies to test a backfill. Heavy work runs through useMemo so the UI stays snappy on large inputs. Same input + same options yields identical bytes — the kind of stability snapshot tests rely on.

feature-detected

Expiry checks

Validate cookie TTLs without waiting weeks. Storage tools persist to the right backend: localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data. Pick the right shelf and quota worries disappear.

deterministic

Cross-domain audit

Compare cookies across staging and production. Browser feature detection: clipboard, fullscreen, gamepad, and Web Bluetooth APIs gracefully fall back when unavailable. No surprise white screens on Safari or older Firefox.

production-ready

FAQ

Frequently asked questions

Why can't I see all my cookies?

HttpOnly cookies are hidden from document.cookie by design. Use your browser DevTools to inspect them.

Why can't I delete this cookie?

Cookies can only be deleted on the exact path and domain they were set on. Use DevTools for cross-path deletions.

Are these cookies sent to the server?

Yes, they belong to this origin's cookie jar — they ride along with every request to this origin.

What about SameSite and Secure flags?

We don't surface those because document.cookie can't read them. DevTools is the right place for those checks.

Is anything sent to a server?

No. Inspection and edits happen entirely in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!