What this tool does
Every cookie a site sends carries three optional security attributes — Secure, HttpOnly, and SameSite — that determine who can read the cookie and under what circumstances it gets sent. This tool fetches a page's Set-Cookie headers and shows, for each cookie, which of these attributes are present.
Secure: never travel unencrypted
Without the Secure attribute, a browser will send a cookie over an unencrypted HTTP connection just as readily as over HTTPS — even on a site that normally redirects to HTTPS, a cookie missing Secure is theoretically interceptable on that first HTTP request before the redirect fires, or on any subdomain still reachable over plain HTTP. This attribute costs nothing to add: no fully-HTTPS site has a legitimate reason to skip it.
HttpOnly: locking JavaScript out
An XSS (cross-site scripting) flaw lets an attacker run arbitrary JavaScript in the context of your page. Without HttpOnly, that script can read document.cookie and exfiltrate the session cookie straight to a third-party server — the classic session-hijacking scenario. With HttpOnly set, the cookie stays invisible to JavaScript even on a compromised page, forcing the attacker to find an entirely different way to exploit the flaw.
SameSite: limiting cross-site requests
SameSite controls whether a cookie gets sent when a request originates from another site — the mechanism behind most CSRF (cross-site request forgery) attacks, where a malicious site triggers an action on a site the victim is logged into, relying on cookies being sent automatically. Strict blocks these cross-site sends entirely, Lax (the modern browser default) allows direct navigation but blocks automatic requests, and None turns the protection off.
Why some cookies don't need any of these attributes
A site often sets several cookies with very different roles: a session cookie (worth protecting carefully), a light/dark theme preference cookie (no real security stakes), and sometimes a third-party cookie dropped by an analytics or ad tool (outside the site's direct control). This tool flags missing attributes on every cookie it finds — it's up to you to judge which ones actually matter based on what each cookie stores.