document.cookie, live

Cookie Editor

See every cookie visible to this page, edit values inline, add new cookies with a custom expiry and path, and delete any of them with one click.

0 cookies found
NameValue

This only shows cookies readable by JavaScript on this page. HttpOnly cookies are invisible here by design — browsers block script access to them to reduce the damage a cross-site scripting bug could do. Editing re-sets a cookie using path=/, which updates most cookies correctly but may create a duplicate if the original was set with a different, more specific path.

Nothing here leaves your browser — every change happens directly through document.cookie.

🍪

Live table, real cookies

Parsed straight from document.cookie on this page — not a simulation.

✎

Add, edit, delete

Full control over cookies this page can see, with a custom expiry and path.

🔒

Honest about HttpOnly

Explains clearly why some cookies can never appear here, instead of pretending otherwise.

How to use the cookie editor

Inspect and manage the cookies this exact page can see, right from the table.

  1. Review the tableEvery cookie visible to document.cookie on this page is listed with its name and value.
  2. Edit, delete or addClick a value to edit it, delete a row outright, or add a brand new cookie with the form.
  3. Refresh after external changesIf a cookie changes outside this tool, click Refresh to re-parse document.cookie.

What JavaScript can and cannot see about cookies

document.cookie gives script a simple, flat string of name=value pairs for the current page — it does not expose each cookie's path, domain, expiry or security flags the way a server sees them in the Cookie header. That is a real limitation of the browser API, not something this tool chooses to hide. Writing a cookie, by contrast, does let you set those attributes, which is how this editor's add and delete actions work.

Reading is flat

All you get back is name=value; you cannot ask the browser which path or domain a given cookie was set with.

Writing is attributed

Setting document.cookie lets you specify expires, path, domain, SameSite and Secure, but each write only affects one cookie at a time.

HttpOnly is a hard wall

Cookies flagged HttpOnly by the server are completely invisible to JavaScript, on every website, by browser design.

Same-origin scoped

A page can only see cookies that match its own domain and path rules, never another site's cookies.

Cookie editor FAQ

Common questions about scope and limitations.

Can this tool see cookies from other websites?

No. Cookies are scoped to the domain and path that set them, and document.cookie only ever returns cookies that belong to the current page's origin. This tool can only manage cookies visible to pandatoolbox.com pages, never another site's cookies.

Why can't I see every cookie set on this page?

Cookies marked HttpOnly are deliberately hidden from JavaScript's document.cookie as a security measure against cross-site scripting attacks. If a site sets HttpOnly cookies, no browser-based tool, including this one, can read or list them.

Why did editing a cookie create a duplicate instead of replacing it?

A cookie is only overwritten when the new one is set with the exact same name, path and domain as the original. This tool edits using the root path (/), which updates most cookies correctly, but a cookie originally set with a more specific path may end up duplicated rather than replaced.

What does the expires-in-days field actually do?

It calculates a future date that many days from now and writes it as the cookie's expires attribute. Leaving it blank creates a session cookie, which most browsers clear when the browser itself is closed.

Is any of this sent to a server?

No. Every read, add, edit and delete happens directly through document.cookie in your browser. My Panda Toolbox never receives this data.

Explore more free tools: LocalStorage InspectorBrowser Feature DetectorUser-Agent String ParserAll Features