A cookie converter is a tool that translates the text of an HTTP Cookie request header into a structured format — usually a JSON object map of name and value pairs — and converts that map back into a valid header string. Unlike generic parsers, a strict cookie converter enforces the request serialization rules from RFC 6265: every pair must be name=value, multiple pairs must be separated by exactly a semicolon followed by one ASCII space, and the first equals sign in each pair is the only structural separator. Percent sequences, additional equals signs, and quoted values are preserved literally rather than decoded. A real cookie converter also refuses to parse Set-Cookie response headers, because attributes such as Domain, Path, Expires, Secure, and HttpOnly are sent by the server and never appear in the browser's request field. That single distinction is the difference between a tool that helps you debug session traffic and one that quietly fabricates data that does not exist.
What a Cookie Converter Actually Does
A cookie converter works on one specific field: the value of the HTTP Cookie request header that a browser sends to a server. Its job is to take that flat string of name=value pairs and turn it into a structured representation — most commonly a JSON object where each cookie name becomes a key and each value becomes a string. The reverse direction takes a flat JSON object of strings and emits the exact header text a request would carry.
When you inspect a request in your browser's network tab, you can copy the Cookie value as plain text. That text is awkward to read, hard to diff, and impossible to query. The Cookie to JSON Converter reads the field, validates it against the request serialization profile from RFC 6265, and produces a two-space indented JSON object so you can read or paste it into other code. The reverse direction is useful when you are reproducing a request from a review: take reviewed JSON strings and rebuild a header that the server will accept. For a broader walkthrough of going both directions, see the Convert Cookie Headers to JSON and Back in Your Browser guide.
Why Request Cookies and Set-Cookie Are Not the Same Thing
This is the most common point of confusion, and it is where many generic cookie tools go wrong.
The Cookie request header contains only what the browser sends: one or more name=value pairs that identify which cookies apply to the current request. It carries no metadata about expiry, scope, or security flags, because those flags are set by the server when the cookie is created and never travel back to the server with subsequent requests.
The Set-Cookie response header is the opposite. It is what the server sends to the browser to create or modify a cookie, and it can carry attributes such as Domain, Path, Expires, Max-Age, Secure, HttpOnly, SameSite, Partitioned, Priority, and extension keys. Those attributes shape future Cookie requests, but they are not part of any Cookie request field.
| Aspect | Cookie request header | Set-Cookie response header |
|---|---|---|
| Direction | Browser → Server | Server → Browser |
| Carries attributes such as Domain, Path, Secure, HttpOnly | No | Yes |
| Format | name=value pairs joined by ; | name=value plus attributes |
| Handled by a request cookie converter | Yes | No (explicit error) |
A serious cookie converter handles Cookie only. Pasting a line that begins with Set-Cookie: produces an explicit error instead of fabricating a JSON object that pretends those attributes exist in the request field. That distinction protects you from debugging with phantom data.
The Strict Parsing Rules Behind a Real Cookie Converter
RFC 6265 defines a small but precise serialization profile. A converter that respects it checks every one of the following rules, as documented in RFC 6265 — HTTP State Management Mechanism.
The optional field-name, if you include it, must be the exact string Cookie followed immediately by a colon. Cookie : with a space before the colon is malformed. The field-name itself is matched case-insensitively, so COOKIE:a=1 is accepted.
Each pair must be a name, an equals sign, and a value, with no spaces around the equals sign. The equals sign only acts as a separator at its first occurrence inside a pair. A value such as abc==, a signed token, or a URL containing = characters keeps every equals sign after the first as data.
Pairs are separated by exactly a semicolon followed by one ASCII space. Two spaces, no space, or a trailing semicolon are rejected rather than silently repaired.
Names follow the RFC token profile and remain case-sensitive. SID and sid are two different names. Values follow the cookie-octet profile or the same characters wrapped in double quotes; raw spaces, commas, semicolons, backslashes, controls, and characters outside that profile are rejected.
Percent sequences are never URL-decoded. %2F stays as the three characters percent, two, and F. JSON escapes are decoded before cookie validation, so an escaped newline in a JSON value fails because the decoded control character is not valid cookie-value data.
Duplicate names are rejected rather than using first-wins or last-wins, because JSON cannot preserve two members with the same decoded key without choosing a winner. The names __proto__, prototype, and constructor are rejected as a defense-in-depth boundary against prototype pollution in downstream code, even though the internal map has no prototype.
Input is capped at exactly 100,000 UTF-16 code units and output at 200,000. The interface never silently truncates; the next unit past the limit is rejected.
How to Convert a Cookie Header to JSON in Your Browser
The Cookie to JSON Converter is built around these rules and runs entirely in your browser tab, so nothing you paste is uploaded.
- Open the Cookie to JSON Converter and choose the Cookie to JSON direction.
- Paste either a bare Cookie request value such as SID=abc; lang=en-US or the exact prefixed form Cookie: SID=abc; lang=en-US. Outer ASCII spaces around the pasted line are ignored for convenience.
- Convert. The output appears in a read-only area as a two-space indented JSON object, with every preserved string and the pair count visible.
- Switch to JSON to Cookie when you need to rebuild a header. Paste exactly one nonempty JSON object whose values are all strings, then convert.
- Copy the complete output with the built-in button. If clipboard permission is denied, the full output remains visible for manual selection.
Every edit or direction switch clears the previous result, error, pair count, and clipboard status. The tool never reads document.cookie, never modifies the browser cookie store, and never issues an HTTP request.
What a Strict Cookie Converter Rejects and Why
A strict converter is strict for a reason. The following inputs all fail rather than producing a misleading result:
| Input shape | Result |
|---|---|
| SID=abc; lang=en-US | Accepted |
| Cookie: SID=abc | Accepted |
| COOKIE:a=1 | Accepted |
| a = b | Rejected (spaces around equals) |
| a=b;c=d | Rejected (missing separator space) |
| a=b; c=d; | Rejected (trailing semicolon) |
| Set-Cookie: SID=abc; Path=/ | Rejected (response header) |
| {"a": 1} in JSON mode | Rejected (non-string value) |
A strict cookie converter also rejects names containing spaces, separators, or controls; values containing raw spaces, commas, semicolons, backslashes, controls, or characters outside cookie-octet; duplicate names compared case-sensitively in either direction; JSON input that is not a single nonempty object or that contains numbers, booleans, null, arrays, nested objects, comments, trailing commas, or text after the object; escaped characters whose decoded form is not valid cookie-value data, such as an escaped newline; and the keys __proto__, prototype, and constructor, even when the rest of the input is valid.
Privacy, Limits, and When to Use a Different Tool
Because the Cookie field often carries live session identifiers, signed tokens, and authentication state, treat the pasted text as private. Run the converter in a trusted browser tab, avoid pasting real production cookies into shared screenshots, and rotate any credentials that have been exposed.
A cookie converter does not try to be a session decoder. It does not infer paths, sort members, percent-encode forbidden characters, add or strip quotes, or generate Set-Cookie attributes. It also does not decide whether a cookie is secure — only the server's original Set-Cookie attributes tell you that, and the Cookie request field cannot.
For general JSON work — formatting, validating, or compressing unrelated JSON — a dedicated JSON tool is more useful. For unrelated markup cleanup, an HTML cleaner fits the task. Knowing which tool does what keeps each debugging job honest.
Related reading: Cookie Converter for Beginners: Convert Cookies to JSON.