Guide
Converting Netscape cookie files to JSON and back
Command-line programs such as curl, wget and yt-dlp read cookies from a plain text file in a layout that goes back to the Netscape browser. Browser extensions that export cookies often produce JSON instead, and scripts in many languages expect JSON objects. Moving between the two by hand is fiddly because the text format is separated by tabs and reads like a table. This page converts in both directions and reports anything it cannot read.
The file format
The first line is usually a comment, # Netscape HTTP Cookie File, and any line starting with # is ignored apart from one special case. Every cookie occupies a line with seven fields separated by tabs. They are: the domain; TRUE or FALSE for whether subdomains are included; the path; TRUE or FALSE for whether the cookie requires HTTPS; the expiry as seconds since 1970, with 0 meaning a session cookie; the name; and the value. A line that begins with #HttpOnly_ is a cookie that scripts in the page cannot read, and the prefix is stripped from the domain.
The JSON fields
The JSON output follows the names that many browser extensions use: domain, hostOnly, path, secure, httpOnly, session, expirationDate, name and value. The two files describe the same facts in different ways. The subdomain flag and hostOnly are opposites, and a session cookie has no expirationDate in the JSON. Going from JSON to text, the subdomain flag is set from hostOnly and the domain is written exactly as it appears in the JSON, so keep the leading dot in the domain when the cookie should cover subdomains.
Using the page
Pick a direction, paste the cookie file or the JSON, and copy or download the result. Cookies are credentials, so the page holds them only in memory; nothing is written to local storage or sent over the network, and a warning at the top reminds you to treat the output like a password. A count shows how many cookies were read and how many lines were skipped, with the reason for each skipped line, such as a wrong number of fields.
Edge cases
Tabs matter: a file that has had its tabs converted to spaces by an editor cannot be read, and the page reports the lines as skipped. An expiry that is not a number is skipped. JSON input may be an array of cookies or an object with a cookies array. Items that lack a name or a domain are rejected with the item number. Cookie values are kept as written, including characters such as equals signs and percent escapes.
A worked example
The Sample button loads four cookies. session_id is on .example.com, secure, with the expiry 1893456000, and becomes an object with hostOnly false and httpOnly false. theme has an expiry of 0, so the JSON marks it as a session cookie and gives no expirationDate. csrf is on www.example.com with the subdomain flag FALSE, so hostOnly is true, and its path is /account. The last line starts with #HttpOnly_ and becomes a cookie with httpOnly true. Four cookies are read and no lines are skipped.
Limits
Only the Netscape and Mozilla text format and the JSON layout described are supported, not browser cookie databases, encrypted stores or HAR files. The page does not check that cookies are valid, still active or allowed for a site. Keep exported files private and delete them when finished. Use them only with accounts you own, and respect the terms of the sites you use them with.
Related tools
- HTTP Headers to JSON parses Cookie and Set-Cookie headers.
- HAR to cURL turns a recorded request into a command with its cookies.
- cURL to Fetch converts such a command into JavaScript.
- JWT Decoder reads tokens that are often stored in cookies.
Checked against the current version of the Cookies to JSON on .