Cookie Analyzer
Paste cookies you've already collected, from your browser's DevTools, a cookies.txt export, or a cookie-manager extension's JSON export, and this tool classifies each as necessary, functional, analytics, or advertising. It flags third-party cookies, missing Secure/SameSite attributes, and long-lived expiry dates, and estimates which ones likely need prior consent under GDPR/ePrivacy. It doesn't fetch a URL itself: browsers never expose the Set-Cookie header to page JavaScript, on any request, for any site, so pasting cookie data you've already collected is the only approach that works.
Reviewed by Riccardo Dal Cero, Economist & Consultant · Last updated September 27, 2026
How it works
- 1
Collect your site's cookies from DevTools (Application → Cookies), a cookies.txt export, or a cookie-manager extension's JSON export.
- 2
Paste the cookie data and enter your site's own domain.
- 3
Each cookie is classified by name pattern and checked for Secure, HttpOnly, SameSite, and expiry length.
- 4
Review the compliance summary: third-party analytics/advertising cookies are flagged as likely needing consent.
Auditing cookies without a scanning crawler
Most 'cookie scanner' tools load your site in a real browser and record every cookie that gets set. That's infrastructure this toolkit doesn't run; every tool here processes only what you paste, locally. This tool takes the cookie data you already have, which DevTools gives you in seconds, and does the classification and compliance-flagging on it.
Why third-party and long-lived cookies matter most
Under GDPR and the ePrivacy Directive, strictly necessary and session-only first-party cookies generally don't need consent, while third-party advertising/analytics cookies almost always do. Long expiry windows are another common audit flag: a 'preference' cookie set for two years starts to look more like a tracking mechanism than a UX convenience.
Frequently asked questions
Why can't I just paste a URL and have it check the site's cookies automatically?
Browsers never expose the Set-Cookie response header to page JavaScript. It's on the Fetch API's forbidden-header list, enforced by the browser itself regardless of CORS settings or proxies. There's no client-side workaround for this; only a real browser session, or a server with cookie-jar access, can see what cookies a site actually sets. That's why you paste cookies you've already collected.
How does category classification work?
Cookie names are matched against well-known patterns from major analytics and advertising platforms (Google Analytics's _ga family, Meta's _fbp/_fbc, Google Ads' IDE/_gcl_*, common session-cookie names, etc.). Unrecognized names are marked 'Unknown' rather than guessed at, so you always know when a classification is a pattern match versus uncertain.
What counts as 'third-party'?
A cookie is flagged third-party when its Domain attribute doesn't match (or end with) the site domain you entered. That means it was set by, or is readable by, a different organization's domain, which is the usual trigger for consent requirements.
Does this tool give legal advice?
No. It's a pattern-matching aid for finding cookies worth reviewing. Actual GDPR/ePrivacy compliance depends on your consent-management setup, legal basis, and jurisdiction, and should be confirmed with a privacy professional.
What cookie export formats are supported?
A JSON array (like many cookie-manager browser extensions export), the classic tab-separated Netscape cookies.txt format, and plain Set-Cookie-style lines (name=value; Domain=...; Secure; SameSite=...). The tool auto-detects which one you pasted.
Related tools
Embeddable Importer Generator
Generate a copy-paste CSV import widget for your own website.
FatturaPA Validator
Check an Italian e-invoice (FatturaPA) XML for structure, ID checksums and math errors.
EU VAT Number Checker (VIES-style)
Batch-validate EU VAT number checksums and check the OSS €10,000 threshold.