Is -b enough, or do I need -c too?

-b sends the file. -c writes new Set-Cookie values back. Use both when you are following a login flow; use only -b for a read-only fetch.

Why does curl send the cookie but Chrome does not after re-import?

Usually SameSite or host-only. cookies.txt cannot store SameSite. Re-import JSON if the browser must enforce Lax/Strict/None.

Does curl understand #HttpOnly_?

Yes. The prefix is curl’s own convention. This serializer writes it; this parser reads it. Tools that skip # comments drop the cookie — see #HttpOnly_ dropped as a comment.

curl -b cookies.txt from JSON Export

Convert JSON cookies to a curl -b cookies.txt file

curl sends Netscape cookies.txt with -b (and writes updates with -c); convert a JSON export from CookieMan into that file here so HttpOnly cookies keep the #HttpOnly_ prefix.

This is not a curl tutorial for stealing sessions. Export cookies from a browser you already control, convert the text, run curl against hosts you are allowed to test.

curl cookies.txtcurl -b cookiescurl cookie jarJSON to cookies.txt

1
Export JSON from the browser
Open the site in Chrome, export JSON Array from CookieMan (current site). You can also paste Set-Cookie lines; they will be detected.
2
Convert to Netscape on this page
Paste below. Output is cookies.txt. Confirm session cookies use expiry 0 and HttpOnly lines start with #HttpOnly_.
3
Call curl
Save the output as cookies.txt and run curl -b cookies.txt -c cookies.txt https://example.com/dashboard. Drop -c if you do not want the jar updated.

Paste JSON cookie array

Output format

Output

Cookies are credentials. Conversion stays in this page — delete the file when you are done.

curl cookie flags versus this file

Flag	Role	File requirement
`-b cookies.txt` / `--cookie`	Send cookies	Netscape or `name=value` string
`-c cookies.txt` / `--cookie-jar`	Write Set-Cookie back	Will rewrite the file in Netscape
`--junk-session-cookies`	Drop expiry `0` on write	Do not use if you need session tokens
`-b "name=value"`	Inline header, no file	No domain — fine for one host, not a jar

            curl -b cookies.txt -c cookies.txt https://example.com/dashboard

# inspect what curl wrote back
# HttpOnly cookies remain prefixed:
# #HttpOnly_.example.com	TRUE	/	TRUE	0	session_id	abc123

Netscape has no SameSite column. curl will still send the cookie on requests you make; Chrome may not if you re-import the jar. Keep JSON for browser import — SameSite lost in cookies.txt.

What curl’s reader rejects

Space-separated columns (tabs only) — repaired here if the TRUE/FALSE pattern is intact.
13-digit expiry — converted to seconds with a warning.
JSON — curl will not parse a CookieMan array as a jar. Always export Netscape.

Related guides

July 29, 2026 3 min read

wget --load-cookies File from JSON

Convert a JSON cookie export to Netscape cookies.txt for wget --load-cookies. Keep session cookies with --keep-session-cookies or wget will drop expiry 0 on save.

wget --load-cookieswget cookies.txt Open the guide

July 26, 2026 3 min read

yt-dlp cookies.txt from Chrome Export

Convert Chrome JSON or a browser dump to the Netscape file yt-dlp --cookies expects, with tabs, Unix seconds and #HttpOnly_ session cookies intact.

yt-dlp cookies.txtyt-dlp --cookies Open the guide

August 9, 2026 3 min read

SameSite Lost in cookies.txt Exports

Netscape cookies.txt has no SameSite column. JSON → Netscape → JSON always yields unspecified. Keep JSON Array when Lax, Strict or None must survive Chrome import.

SameSite cookies.txtSameSite Netscape Open the guide