Parsed Cookies
Analyze Cookie Budget
Paste raw Cookie: or Set-Cookie: lines to measure byte usage and limit risk before production.
Calculation runs locally in your browser.
name=value pairs.Total Cookie Bytes
Cookie Request Header
Largest Cookie
Cookie Count Utilization
Request Header Utilization
Budget Alerts
- No data yet. Paste cookie lines to begin analysis.
Per-Cookie Breakdown
| Cookie Name | Total Bytes | Request Bytes | Source | Status |
|---|---|---|---|---|
| No parsed cookies yet. | ||||
About This Tool
Cookie bugs often do not appear in local testing because small test accounts produce small cookies. In production, richer sessions,
long preference payloads, and third-party integrations can push headers over limits and trigger hard-to-debug failures. This
calculator helps you catch those risks early by showing cookie size at two levels: each cookie individually and the full
Cookie request header as a whole.
The per-cookie budget is typically treated as about 4096 bytes, but exact enforcement differs between browsers. The request header budget is even more environment-dependent because proxies, CDNs, and app servers each have their own limits. That is why this tool exposes editable budget fields instead of fixed rules. You can match your real infrastructure and track how close your current payload is to rejection thresholds.
For Set-Cookie input, total bytes include cookie attributes such as Path, Domain,
Expires, SameSite, and security flags. For request size, the tool estimates what the browser sends:
only name=value pairs in the Cookie header. This split helps you answer two different engineering
questions: "Will this cookie fit browser limits?" and "Will this request fit header limits?"
Common Practical Budgets
| Metric | Typical Budget | Notes |
|---|---|---|
| Per cookie size | 4096 bytes | Widely used compatibility target across modern browsers. |
| Cookies per domain | 20 to 50 | Varies by browser; lower counts reduce request overhead. |
| Request header section | 8 KB to 16 KB | Depends on proxy/server defaults and upstream services. |
Optimization Checklist
- Store opaque session IDs, not large JSON blobs.
- Remove stale experiment flags from long-lived cookies.
- Prefer server-side session storage for heavy state.
- Scope cookies narrowly with
PathandDomainwhen possible. - Audit third-party scripts that set extra tracking cookies.
Privacy & Limitations
- All calculations run entirely in your browser -- nothing is sent to any server.
- Results are computed locally and should be verified for critical applications.
Related Tools
- RICE Score Calculator -- Prioritize features using Reach, Impact, Confidence, Effort scoring
- Cron Expression Generator -- Build and decode cron expressions with a visual editor and next-run preview
- YAML Validator -- Validate YAML syntax and convert to JSON
- IP Address Converter -- Convert between IPv4 decimal and binary notation
Related Tools
View all toolsBig-O Notation Visualizer
Interactive plot of O(1) through O(n!) complexity curves with operation count comparison
JSON Formatter
Format and beautify JSON with proper indentation
JSON Validator
Validate JSON syntax and show errors
CSV to JSON Converter
Convert CSV data to JSON format with auto-detection
JSON to CSV Converter
Convert JSON arrays to CSV format with nested object handling
JWT Decoder
Decode JWT tokens and display header and payload
Cookie Size Budget Calculator FAQ
What cookie size limit should I use?
Most browsers support roughly 4096 bytes per cookie, but behavior varies by browser and version. Use 4096 bytes as a practical budget, then test your target browsers.
Why does request header size matter for cookies?
Cookies are sent in the Cookie request header. If the total header section gets too large, proxies or servers may reject requests with errors like 400 or 431.
Does this tool send my cookies to a server?
No. All parsing and calculations happen entirely in your browser. No input data is uploaded.
Should I include cookie attributes in size checks?
For Set-Cookie analysis, yes. Attributes like Path, Domain, Expires, SameSite, and Secure add bytes. For request header analysis, only name=value pairs are sent.