Skip to main content
Back to Dev generators

Dev

Fake Browser Cookie Generator

Used by developers, writers, and creators worldwide.

A fake browser cookie generator gives developers syntactically valid HTTP cookie strings in seconds, without constructing each attribute by hand. Real cookies need more than a name and value — expiry timestamps must follow RFC 1123, domains and paths must be plausible, and security flags like HttpOnly, Secure, and SameSite must be present or absent depending on your scenario. Set the count to however many your test requires — a few for a quick unit test, fifty-plus for parser stress tests — then toggle Secure and HttpOnly flags on or off to match your target environment. The output drops straight into Postman, curl, Playwright fixtures, or middleware test suites without any reformatting.

Loading usage…

Free forever — no account required

How to use

  1. Choose your options above
  2. Click Generate
  3. Copy your result

Detailed instructions

  1. Set the Number of Cookies field to the quantity your test scenario requires.
  2. Choose Yes or No in the Secure/HttpOnly toggle to match your target cookie configuration.
  3. Click Generate to produce a fresh batch of randomized, properly formatted cookie strings.
  4. Copy individual cookies or the full list into your HTTP client, test fixture, or script.

Use Cases

  • •Fuzz-testing a custom HTTP cookie parser with a batch of 50 varied cookie strings
  • •Populating Postman pre-request scripts with realistic session and auth cookies
  • •Seeding Playwright or Cypress multi-user end-to-end tests with per-user cookie fixtures
  • •Testing Express or Django middleware that enforces HttpOnly and Secure flag requirements
  • •Building controlled lab environments for CSRF research using cookies without Secure flags

Tips

  • →Generate cookies without Secure/HttpOnly flags when testing legacy code paths or local HTTP-only dev servers that reject strict cookies.
  • →Combine multiple generated cookie strings into a single Cookie: header line separated by semicolons to simulate realistic multi-cookie browser requests.
  • →Use a count of 50 or more to stress-test parser performance and check whether your application silently drops cookies beyond a per-domain limit.
  • →Paste generated cookies into browser DevTools under Application > Cookies to manually inject sessions into a running app without writing any code.
  • →When writing Playwright tests, load generated cookies via context.addCookies() to pre-authenticate test users without going through the login UI each time.
  • →Cross-check generated cookie names against your application's expected cookie names to write negative tests confirming unknown cookies are safely ignored.

FAQ

how do I add fake cookies to a curl request for testing

Copy a generated cookie string and pass it with curl's -H flag: curl -H 'Cookie: sessionId=abc123; userId=xyz456' https://yourapi.com/endpoint. For multiple cookies, combine them in one Cookie header separated by semicolons, or use --cookie with a file — the generated format is compatible with both.

can I use these fake cookies to log in to a real website

No — the values are random strings with no relation to any live server's session store, so a real application will reject them or create a new session. These cookies are strictly for testing parsers, middleware, and mock environments where server-side validation is either absent or under your control.

what's the difference between the Secure flag and HttpOnly flag on a cookie

Secure restricts the cookie to HTTPS connections only, while HttpOnly blocks JavaScript from reading it via document.cookie. They serve different threats — Secure prevents interception on unencrypted connections, HttpOnly mitigates XSS-based token theft. This generator lets you toggle both on or off so you can test hardened and legacy configurations side by side.