Which one should I copy from Chrome DevTools?

Set-Cookie from the response that established the session, if you still have it. The request Cookie header is a fallback that loses flags.

Why did Domain become .example.com?

On Set-Cookie parse, a Domain without a leading dot is stored with a dot and hostOnly: false. That matches typical browser host-scoping for Domain attributes.

Can I convert JSON back to Set-Cookie lines?

Yes — set output to Set-Cookie. Host-only cookies still emit Domain= if domain is non-empty, so a Set-Cookie round-trip can clear host-only. Prefer JSON Array for host-only fidelity.

Cookie Header vs Set-Cookie Conversion

Cookie header vs Set-Cookie: request line versus response

The Cookie header is what a client sends; Set-Cookie is what a server sends. Paste either here — detection picks Set-Cookie if a line starts with that name or contains Domain/Path/Expires attributes, otherwise a header string.

Do not concatenate them. A merged blob confuses attribute tokens with cookie names.

Cookie vs Set-CookieSet-Cookie to JSONCookie header formatrequest vs response cookies

1
Copy one side of the exchange
From DevTools: request Headers → Cookie, or response Headers → Set-Cookie. From a HAR, copy those header values only.
2
Convert to JSON Array
Paste below. Set-Cookie keeps Domain and flags. A Cookie header will warn and use localhost.
3
Import or replay
JSON → CookieMan Import. Netscape → curl. Header String → Axios/httpie. Match the artefact to the consumer.

Paste Set-Cookie lines or a Cookie header

Output format

Output

Cookies are credentials. Conversion stays in this page — delete the file when you are done.

Side-by-side attributes

Attribute	Cookie: request	Set-Cookie: response
name=value	Repeated, semicolon-separated	First pair on the line
Domain / Path	Absent	Parsed; Domain gets a leading dot if missing
Expires / Max-Age	Absent (session)	Unix seconds; Max-Age is now + N
Secure / HttpOnly / SameSite	Absent	Parsed
Partitioned	Absent	Token recognized, partition key not stored
Quoted values with `;` inside	Splitter respects quotes	Same splitter

Detection: if the text matches /^set-cookie:/im or contains Domain=/Path=/Expires=/HttpOnly/Secure/SameSite=, it is treated as Set-Cookie. A plain a=1; b=2 is a header string.

Max-Age is computed at parse time

Max-Age=3600 becomes expirationDate = floor(now/1000) + 3600. The JSON you download is not a portable encoding of Max-Age; it is a snapshot. Re-parse later and the absolute expiry is what it is. Expires is an absolute HTTP date and does not move.

            Set-Cookie: sid=abc; Domain=example.com; Max-Age=3600; Secure; HttpOnly
Cookie: sid=abc

Related guides

July 27, 2026 3 min read

HAR Set-Cookie Headers to JSON

CookieMan does not parse a whole HAR JSON file. Copy the Set-Cookie lines out of the response and convert them to a JSON array with Domain, Path, flags and Expires.

HAR Set-CookieHAR cookies to JSON Open the guide

August 4, 2026 3 min read

Axios Cookie Header from JSON Export

Convert a JSON cookie array to a Cookie header for Axios in Node. Browsers ignore this header. HttpOnly cannot appear on the wire.

Axios Cookie headerAxios cookies Open the guide

July 22, 2026 3 min read

Postman Cookie Header to JSON

Paste a Postman Cookie header and turn name=value pairs into a JSON array. Domains default to localhost until you set them — then import or send via curl.

Postman cookiesPostman Cookie header Open the guide