Can I set Domain=.example.com on a __Host- cookie if hostOnly is true?

No. The name forbids a Domain attribute. Chrome rejects the write. Use the exact host and hostOnly: true.

Does this page apply the cookie to Chrome?

No. It rewrites JSON. The extension’s Import calls chrome.cookies.set, which still enforces prefixes.

Why did Netscape export break my __Host- cookie?

The serializer writes a domain field for every row. Re-importing that file is not host-only. Stay on JSON for prefixed cookies — JSON vs cookies.txt.

Fix __Host- Cookie Rejected by Chrome

Fix __Host- cookies rejected by Chrome

Chrome rejects a __Host- cookie unless it is Secure, Path=/, and host-only (no Domain attribute). The sample below fails all three — rewrite it to hostOnly: true, path: "/", secure: true, and a domain without a leading dot.

__Secure- only requires the Secure flag. Mixing the two prefixes is a common import failure after a Netscape round-trip that added a dotted Domain.

__Host- cookie rejected__Host- prefix__Secure- cookiehost prefix cookie Chrome

1
Read the name prefix
If the cookie name starts with __Host- or __Secure-, Chrome’s prefix rules apply on every write, including CookieMan save and Import.
2
Fix the JSON in the converter
Paste the object. Adjust fields in the output (or in the input and reconvert). The tool does not auto-correct prefixes — illegal combinations stay illegal until you edit them.
3
Import on the exact host over HTTPS
Open https://example.com (not a subdomain if the cookie is host-only). Import → Apply. If Chrome still rejects, the popup shows the API error.

Paste JSON with a bad __Host- cookie

Output format

Output

Cookies are credentials. Conversion stays in this page — delete the file when you are done.

Prefix rules Chrome enforces

Prefix	Required	Typical broken export
`__Host-`	`Secure`, `Path=/`, no Domain (host-only)	Netscape added `.example.com` and column 2 TRUE
`__Secure-`	`Secure`	Imported onto http://

Netscape column 1 with a leading dot plus column 2 TRUE is the opposite of host-only. Exporting a __Host- cookie to cookies.txt and back will usually make Chrome reject it. Keep JSON Array for prefixed names.

Legal JSON for a __Host- cookie

            {
  "name": "__Host-session",
  "value": "abc123",
  "domain": "example.com",
  "path": "/",
  "secure": true,
  "httpOnly": true,
  "sameSite": "lax",
  "hostOnly": true
}

Related guides

August 16, 2026 3 min read

Fix SameSite=None Without Secure

Chrome rejects SameSite=None unless Secure is set. The converter will not override the browser. Paste JSON, set secure true, then import on HTTPS.

SameSite=None without SecureSameSite None rejected Open the guide

August 5, 2026 3 min read

JSON Array vs cookies.txt Field Mapping

Side-by-side mapping of CookieMan JSON Array fields to Netscape cookies.txt. SameSite, partitionKey and store metadata never survive the seven-column file.

JSON vs cookies.txtcookies.txt field mapping Open the guide

July 19, 2026 3 min read

Cookie-Editor Alternative for Chrome (MV3)

Cookie-Editor is a cookie inspector. CookieMan is a Manifest V3 editor that imports the same JSON and converts it to cookies.txt, headers or Base64.

Cookie-Editor alternativeCookie-Editor Chrome Open the guide