How do I check a website's cookies online?

Enter an address and click Check. The tool sends a request from our server and lists the cookies from the Set-Cookie headers: name, domain, lifetime, the Secure and HttpOnly flags, SameSite and a list of remarks. No sign-up; the limit is 20 checks per minute.

Does the check see tracker and analytics cookies?

No. Google Analytics, ad pixel and consent banner cookies are created by JavaScript in a browser, and the tool does not run a browser. Only cookies that the server sets in the HTTP response are visible here.

What do the Secure, HttpOnly and SameSite flags mean?

Secure sends the cookie only over HTTPS. HttpOnly blocks reading the cookie from JavaScript, which lowers the risk of theft in an XSS attack. SameSite limits sending the cookie in cross-site requests (Strict, Lax or None; None requires Secure).

Does the tool check GDPR compliance?

No. It does not classify cookies and does not check the banner or consent. That needs a scanner which opens the page in a browser, records cookies before and after consent and classifies them.

Why are there no cookies although my browser has some?

Most likely a script on the page creates them, or the server sets them only after login, for a certain language or on another request. We make one GET to the address and read the headers of the final response.

What should I do if a session cookie lacks HttpOnly or Secure?

Turn the flags on in the application or server settings: for example session.cookie_secure and session.cookie_httponly in PHP, or the matching options of your framework. Then check the Set-Cookie header again.

IP y red

Verificación de cookies

Análisis de cookies del sitio: atributos de seguridad y duración. El consentimiento GDPR (banner, categorías) no se comprueba.

Website cookie check: enter an address and the tool lists the cookies the server sets in its response, with the Secure, HttpOnly and SameSite flags. These are only server Set-Cookie headers; tracker, consent banner and script cookies are not visible here, and there is no GDPR compliance check.

Precio: Gratis
Registro: No necesario
Procesamiento: On our server: we send one GET request to the address and parse the Set-Cookie headers from every step of the redirect chain; no browser and no page scripts run
Entrada: One public URL or domain
Límites: 20 checks per minute per IP; we wait up to 15 seconds; only cookies that the server sets in headers are visible, not those created by scripts, and not third-party ones
Resultado: A cookie table: name, value, domain, path, lifetime, the Secure and HttpOnly flags, the SameSite value; a Secure/HttpOnly/SameSite summary and a list of security remarks
Última actualización: 2026-10-26

Verificación de cookies del sitio web

Analiza las cookies que establece un sitio: nombres, valores, flags (Secure, HttpOnly, SameSite) y duración. Se recopilan las cookies de cada paso de la cadena de redirecciones; la herramienta no verifica si existe consentimiento de cookies conforme al RGPD.

Lista de todas las cookies

Indicadores de seguridad (Secure, HttpOnly)

Política SameSite

Caducidad de las cookies

Cómo usar

Introduce la URL de un sitio web para analizar las cookies que se establecen
La herramienta cargará la página y recopilará todas las cookies con sus parámetros de seguridad
Comprueba los flags Secure, HttpOnly y SameSite y la duración de cada cookie

FAQ

Comparamos solo lo que está confirmado en las páginas de cada servicio. Donde no pudimos confirmar un dato, la celda muestra "—".

Parámetro	PromoPilot	Cookiebot Cookie Checker	CookieYes Cookie Checker	MDN: Set-Cookie
Gratis y límites	Yes: 20 checks per minute	Free forever; page limits not stated	A free scan; limits not stated	Reference, not a scanner
Email or account needed	✗	An email address is needed: the report is emailed	No account requirement stated on the page	—
JavaScript and third-party cookies	✗	✓ JavaScript, dynamic and third-party cookies	—	—
Cookie categorisation	✗	✓	✓ Necessary, Functional, Analytics, Performance, Advertisement	✗
Secure / HttpOnly / SameSite flags	✓	—	—	Explains Secure, HttpOnly, SameSite
Privacy-law compliance check	✗	✓ checked against privacy regulations	—	✗

Desplaza la tabla hacia los lados

Dónde somos más débiles: we see only cookies from the Set-Cookie headers of every redirect step, do not detect categories, the consent banner or third-party cookies, and have no GDPR check or emailed report.

Cuándo elegir PromoPilot: When you want to check in seconds which security attributes the server uses for session and service cookies. For a consent audit and GDPR categorisation of trackers, use a scanner that runs the page in a browser.

Comprobado el: 2026-10-16. "—" significa que no está confirmado en la página oficial; las condiciones y los precios cambian, así que consulta los sitios de cada servicio.