cookies.txt Converter

It is the plain-text cookie file format used by curl, wget and many download managers. Each line holds one cookie as seven TAB-separated fields: domain, include-subdomains flag (TRUE/FALSE), path, secure flag (TRUE/FALSE), expiry as a Unix timestamp (0 means a session cookie), name, and value. Lines starting with # are comments.

HttpOnly cookies cannot be read by browser JavaScript, so the format cannot mark them with a normal field. Instead the domain is prefixed with #HttpOnly_, for example #HttpOnly_.example.com — without the prefix the line would look like a comment. The converter parses these lines as cookies, keeps the flag, and writes the prefix back on export.

Set the input format to "Netscape cookies.txt" and the output format to JSON, then press Convert. Every line becomes an object with domain, includeSubdomains, path, secure, expires (Unix seconds, 0 for a session cookie), name, value and httpOnly fields — convenient for scripts, tests and automation.

For the target URL the converter applies the RFC 6265 sending rules: the host must match the cookie domain (subdomains included when the flag is TRUE), the URL path must match the cookie path, Secure cookies are only sent over HTTPS, and already-expired cookies are skipped. Matches are ordered longest path first and joined as name=value pairs separated by "; ".

A Cookie header carries only names and values — no domain, path, expiry, Secure or HttpOnly metadata. Import creates host-only session cookies for the host of the target URL, using the path and Secure options you set, with HttpOnly=false. These are new assumptions, not recovered metadata.

In cookies.txt the fourth field is the Secure flag (TRUE/FALSE); in JSON it is a boolean. When a header is built, Secure cookies are dropped unless the target URL is HTTPS. Expiry is a Unix timestamp in seconds — 0 means a session cookie — and cookies that have already expired are excluded from header output.

No. Values are treated as opaque text and copied verbatim in every conversion; nothing is decoded, re-encoded, decrypted, re-signed or refreshed. If a name or value contains characters a Cookie header cannot carry, header export stops with an error — choose JSON output instead, which preserves such values unchanged.

No. Parsing and conversion run entirely in your browser with JavaScript — no upload, no server round-trip. Still, treat cookie files as credentials: never share authentication cookies, and only inspect Cookie headers you are authorized to use.