Set-Cookie Header Builder
Compose one valid Set-Cookie response header from explicit attributes.
Build one explicit Set-Cookie header
Set-Cookie combines a name and encoded value with scope, lifetime, cross-site, transport, and script-access attributes. This builder validates HTTP token syntax for the name, requires paths to begin with a slash, checks integer Max-Age, formats an optional Expires date, and appends Secure, HttpOnly, and SameSite choices in a predictable order.
The defaults produce a session cookie whose value abc space 123 is percent-encoded, scoped to the root path, retained for 3600 seconds, restricted to secure transport and HTTP access, and set to SameSite Lax. SameSite None without Secure is rejected because modern browsers require the attributes together.
Security attributes and browser rules
Cookie security depends on deployment context as well as syntax. Domain changes host-only behavior, Path is not an access-control boundary, and Max-Age can override Expires in supporting clients. Header generation stays in your browser and sets no cookie. Review CSRF protections, session rotation, prefixes, HTTPS, and whether persistent storage is appropriate before sending the header from a server.
Frequently Asked Questions
Why does SameSite None require Secure?
Modern browsers reject cross-site SameSite None cookies unless Secure is also present.
What is the difference between Max-Age and Expires?
Max-Age is a relative lifetime in seconds; Expires is an absolute date, and Max-Age generally takes precedence when both are supported.
Does this page set the cookie in my browser?
No. It only creates header text and does not modify document cookies or contact a server.
Browse the full set of free, private, in-browser tools.