# Cookie Header Explainer | Explain cookie scope and cache reuse rules

Cookies rejected or personalized responses cached? Fetch a page or paste headers to explain Set-Cookie, Cache-Control, Vary and ETag. Pasted headers stay local.

Canonical: https://tamperbox.dev/cookie-header-explainer

Docs: https://docs.tamperbox.dev/tools/cookie-header-explainer.md

Updated: 2026-10-27

Reviewed: 2026-10-27

## How it works

Cookie Header Explainer reads response headers, from a public page our server fetches or from text you paste, and explains every cookie and the cache policy with the evidence behind each finding. Cookies are checked against the browser rules in RFC 6265bis: prefixes, SameSite, size limits, lifetime and scope; cache directives against RFC 9111. The full method, every finding and worked examples are on [docs.tamperbox.dev](https://docs.tamperbox.dev/tools/cookie-header-explainer/).

## Limits and interpretation

The result reads the supplied fields only. The page origin, the request, public suffix rules and what a real browser or cache finally stores are not tested. Cookie values are never displayed: fetched values are redacted by our server, pasted values stay in your browser and only their length is shown. Inputs are limited to 1,000,000 characters. Nothing is fetched from addresses inside pasted text.

## Frequently asked questions

### Is my input uploaded?

Pasted headers are not. They are parsed in your browser. A website address is different: our server requests that one page and returns its response headers with cookie values redacted.

### What does the opening result show?

The response headers www.wikipedia.org sent when the page opened, fetched live by our server. The site can change its cookies at any time. If the fetch fails, a synthetic header block is shown instead and labelled Example.

### Does a clean result mean my cookies work?

No. It means the headers follow the rules this page checks. Confirm in the browser's storage panel that each cookie is stored, and in your cache that personalized responses are not reused.

## References

- [RFC 6265bis (draft 22): Cookies, HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22).
- [RFC 6265 section 5: User agent requirements](https://www.rfc-editor.org/rfc/rfc6265#section-5).
- [RFC 9111 section 5.2.2: Cache-Control response directives](https://www.rfc-editor.org/rfc/rfc9111#section-5.2.2).
- [RFC 9111 section 4.1: Calculating cache keys with Vary](https://www.rfc-editor.org/rfc/rfc9111#section-4.1).