Scan a Website for Cookies

🌐

How CFT works

Enter URL

Provide the target website address.

Auto-scan

CFT fetches the site and reads all HTTP Set-Cookie response headers automatically.

Categorize

Each cookie is classified by lifespan, source, security attributes, and type.

Report

Download a standalone HTML report with all findings and remediation steps.

Scan Results

Cookie Type Legend

Session Deleted when browser closes

Persistent Survives browser restarts

First-party Set by the visited domain

Third-party Set by external domains

Secure HTTPS only transmission

Insecure Sent over HTTP too

HttpOnly Hidden from JavaScript

⚠ Zombie Risk May recreate after deletion

All Detected Cookies

Cookie Name	Domain	Type & Category	Security Attributes	Findings & Remediation

ℹ Scan limitations: Cookie values are always redacted. HttpOnly cookies are observed via HTTP response headers only. Results may be incomplete — see the accuracy disclaimer at the top of the page for full details.

Recommended Privacy Tools

Reducing cookie exposure is one layer of protection. These tools address network-level tracking, IP visibility, and credential security.

NordVPN

Threat Protection + no-logs VPN

Blocks tracking cookies and malicious sites at the network level — before they reach your browser. Masks your IP, encrypts traffic, and strips ad trackers from DNS queries.

Get NordVPN →

NordPass

Secure password manager & autofill

Store passwords and passkeys in an end-to-end encrypted vault. A safer alternative to browser-stored credentials that can be exposed through weak session cookies.

Get NordPass →

Disclosure: CFT may earn a commission from qualifying purchases through the above links, at no extra cost to you. We only recommend tools that align with this site’s privacy and security mission.

About Cookie Finder Tool — CFT

A free, open cookie security scanner built for defenders by antibodycyber.com

Purpose

CFT helps security engineers, privacy auditors, penetration testers, and compliance teams quickly enumerate the cookies a website sets and identify security misconfigurations before attackers do.

What CFT Detects

Missing Secure attribute — cookie transmittable over HTTP
Missing HttpOnly — authentication cookies exposed to XSS
Missing or weak SameSite — CSRF risk
SameSite=None without Secure — rejected by modern browsers
Third-party cookies — cross-site tracking domains
Zombie / fingerprinting cookie patterns
Session vs. persistent lifespan classification

How It Works

CFT makes a server-side HTTP GET request to the target URL, follows up to five redirects, and captures all Set-Cookie response headers at each hop. Each cookie is parsed and classified against a security rule set. No browser, JavaScript engine, or user session is involved.

Defender Use Cases

Pre-pentest recon — map cookie surface before engagement
GDPR / ePrivacy audit — identify third-party trackers
Secure SDLC gates — verify cookie hardening before release
Incident response — check if session cookies lack HttpOnly
Vendor assessment — audit third-party SaaS cookie posture
Red team recon — find session cookie weaknesses to exploit

Known Limitations

Does not execute JavaScript — misses cookies set by JS after page load
Does not authenticate — misses cookies behind login walls
Single GET per scan — may miss cookies set only on subpages
Cannot read cookies already stored in your local browser (browser same-origin policy)
HttpOnly cookies are visible via response headers but not their values

Privacy Commitment

Cookie values are always redacted — CFT never logs or stores cookie content
Scan targets are not retained after the response is returned
No analytics, tracking scripts, or third-party SDKs on this page
All scan processing runs on WinCyberScan infrastructure — no data leaves to third parties
This tool sets zero cookies on your browser