A beginner-friendly Cookie to JSON Converter reads the exact text of an HTTP Cookie request header — pairs like SID=abc; lang=en-US separated by a semicolon and one space — and turns it into a flat JSON object whose keys and string values you can read, sort, log, and edit without hand-parsing. The same converter also runs in reverse, taking one reviewed JSON object whose values are strings and producing a clean Cookie: request value again, so you can move between a flat header line and a structured map without losing a single character of permitted value data. Conversion happens entirely in your browser tab; nothing is uploaded, nothing is stored, and document.cookie is never read by the tool. For a developer who is new to HTTP headers, this is the fastest way to inspect the contents of a Cookie field in a structured form, copy it into a config file, diff it against an earlier capture, or rebuild it after edits.
Once you start looking at HTTP traffic, the Cookie field looks deceptively simple. It is one line of text, but the line follows rules that are stricter than most people expect. A single extra space, a missing separator, or a percent-encoded slash can all turn a working header into something a parser rejects. A converter that follows the strict RFC 6265 request profile removes that guesswork: it either accepts your input exactly as written, or it tells you precisely which rule it broke.
What the Cookie Request Header Actually Contains
A browser sends the Cookie field whenever it talks to a server that previously set one or more cookies. The value is a list of name=value pairs joined by ; — a semicolon followed by exactly one ASCII space. Each name is an RFC token, meaning letters, digits, and a small set of punctuation; spaces and commas inside a name are not allowed. Each value is an unquoted sequence of permitted cookie octets, or the same sequence wrapped in double quotes. Spaces around the equals sign are not part of the format. A trailing semicolon, an empty pair, or a missing separator space all make the line invalid.
What the request field does not carry is just as important. The Cookie header does not reveal a cookie's expiry, the host that set it, the path it is bound to, whether it is Secure-only, or whether JavaScript can read it. Those attributes — Domain, Path, Expires, Max-Age, Secure, HttpOnly, SameSite, Partitioned, Priority, and any extension prefix — are part of the Set-Cookie response header, never the Cookie request header. Because beginners often paste Set-Cookie lines by accident, a strict converter rejects that input with a clear error rather than silently producing misleading JSON.
| Header field | Direction | Carries attributes such as Domain, Path, Expires, Secure, HttpOnly? | Handled by the Cookie to JSON Converter? |
|---|---|---|---|
| Cookie | Client to server (request) | No — only name=value pairs | Yes |
| Set-Cookie | Server to client (response) | Yes — attributes are set by the server | No, rejected with an explicit error |
Why a Local Converter Beats Copy-Paste Debugging
When you copy a Cookie field from your browser's DevTools, you usually see something like SID=abc123; lang=en-US; cart=eyJ= — a flat line with no obvious structure. Reading it by eye is fine for two pairs, but it gets painful when there are ten or twenty, and it is easy to introduce a typo when you retype it. A structured JSON view lets you scan the field alphabetically, diff it against a previous capture, or hand a single value to a colleague without quoting headaches.
The other reason to use a local converter is privacy. Cookie headers frequently carry credentials, and shipping them to a third-party service is a real risk. The Cookie to JSON Converter processes the pasted text in the current browser tab and writes nothing back to any network. The output appears in a read-only area you copy manually, and the clipboard action is asynchronous and guarded so a stale permission prompt cannot silently restore a Copied badge after you edit the input or switch direction.
Convert a Cookie Header to JSON in Three Steps
The first direction, Cookie → JSON, is the one most beginners need. Follow the steps below using the Cookie to JSON Converter.
- Open the tool, pick the Cookie to JSON mode, and paste either a bare value such as SID=abc; lang=en-US or the same line prefixed with Cookie: followed by a colon and one space. Outer whitespace around the pasted line is ignored for convenience, per RFC 6265.
- Press Convert. The tool validates the field-name prefix case-insensitively, splits on the first = of every pair, checks each name as an RFC token, and validates each value against the cookie-octet profile. Percent sequences are not URL-decoded — %2F stays the three characters percent, two, F — and additional equals signs past the first remain part of the value, so Base64 padding, signed tokens, and URL-style query strings survive intact.
- Read the JSON map in the read-only output area. Count the pairs against the pair-count line, then use Copy to put the complete string on your clipboard. If anything is malformed, the previous result is removed and a single error message replaces it; fix the input and try again.
Turn JSON Back Into a Cookie Request Value
The reverse direction, JSON → Cookie, is useful when you have edited a captured JSON map and need to rebuild the header line for replay in curl, Postman, or a test harness.
- Switch the tool to JSON to Cookie. Paste exactly one nonempty JSON object whose every property value is a string. Numbers, booleans, null, arrays, nested objects, comments, and trailing commas are all rejected.
- The converter performs a duplicate-aware lexical scan before serialization, so two spellings that decode to the same key — for example a and \u0061 — are caught and reported as a duplicate even though an ordinary JSON.parse would silently retain only one. Keys named __proto__, prototype, or constructor are rejected as a defense-in-depth boundary.
- Press Convert, then review the produced Cookie: value. Pairs are joined with the exact ; separator, decoded values are re-validated as cookie-values, and the original key order from the JSON text is preserved. Copy the line and paste it into your client of choice.
Common Beginner Mistakes the Strict Parser Catches
Several patterns that look harmless in a text editor are explicitly rejected by the strict parser. Spaces around the equals sign, as in SID = 123, fail because they break the pair boundary. SID=123;;lang=en fails because the second separator has no value and an empty pair is not legal. Cookie : SID=123 fails because the colon must touch the field name with no space. Two pairs with the same decoded name, like SID=1; SID=2, fail because a JSON object cannot preserve two members with the same key without silently choosing a winner, and this tool refuses to do that. Pasting a Set-Cookie: line also fails because the tool handles request headers only — the attributes on a Set-Cookie line belong to the server response, not to what the browser sends back.
The strictness is a feature, not friction. If a converter silently trims a space, decodes a percent sequence, or merges two SID= pairs into one, you end up with a successful-looking conversion that does not match what your browser actually sent. Rejecting the input instead forces you to fix the source, and the resulting JSON is guaranteed to round-trip back to the identical Cookie header line.
Limits, Size Budgets, and When to Use a Different Tool
The converter caps input at exactly 100,000 UTF-16 code units and complete output at exactly 200,000 code units, with the next unit past either bound rejected. It does not use maxLength to silently stop your typing, and it never slices, samples, or partially returns input. Any edit or direction switch clears the previous output, error, pair count, and clipboard status, which keeps the result you see in lock-step with the input that produced it.
This tool is the right pick when you want to debug a Cookie request field, move a captured string map into JSON, or rebuild a request-header line from reviewed JSON strings. It is the wrong pick for inspecting document.cookie, generating Set-Cookie responses, decoding an application's session format, deciding whether a cookie is Secure, or sanitizing credentials before sharing — Cookie headers frequently carry live session secrets, and you should rotate any value that has been exposed. For general JSON work, JSON Formatter, JSON Validator, and JSON Minifier cover the cases outside the Cookie profile. For unrelated markup cleanup, an HTML Cleaner is the appropriate tool.