A cookie editor does not need access to every website you visit
Free, and it installs without the read-all-your-data warning.
Every cookie editor I looked at asks for access to all websites at install time. None of them need it. A cookie editor needs the site you opened it on, Chrome has supported asking for exactly that for years, and the broad request is there because it is less work than handling permission granted later.
So this one asks per site, when you open it there. The install prompt is short and the difference in what you can do is nothing.
The other decision worth explaining is the side panel. A popup closes the moment you click back into the page, which is precisely when you want to change a cookie and watch what happens. A panel stays open while you test.
The short version
Cookie Editor does the same job on one tab at a time, which is all a cookie editor ever needed.
- Install it without handing over read and change all your data on all websites, which every other cookie editor asks for.
- Read, edit, add and delete cookies for the tab you are actually on, one click in.
- See which cookies expire when, including the 400 day cap Chrome now quietly applies to all of them.
Best for: developers debugging a session or an auth flow who would rather not widen their attack surface.
Replaces: the popular cookie editors that want every site you visit before they will show you one.
How to use it
- Go to the site whose cookies you want.
- Open the panel and grant access to that site when it asks.
- Every cookie for the site is listed. Search if there are a lot, which there usually are.
- Edit any field, including SameSite, Secure, HttpOnly and expiry.
- Export as JSON if you need to move a session to another profile.
The 400 day thing
Chrome silently truncates any cookie expiry longer than 400 days. Set ten years, get 400 days, no message. I lost a genuinely annoying amount of time to that before working out what was happening.
So this shows the real limit and the real resulting date. If you ask for longer, it tells you what you will actually get rather than accepting the number and quietly doing something else.
What it can access, and why
| Permission | Why it needs it |
|---|---|
| Cookies | Reading and editing them is the entire function. Edits happen in your browser's own cookie store. |
| The current tab | To know which site you are on, so it can show that site's cookies. |
| Side panel | So the editor stays open beside the page while you test a change. |
| Per-site access (optional) | Requested for one site at a time, when you open the editor there. |
Full detail in the privacy policy.
The things people ask before installing
Why does the permission list matter? An extension with access to every site can read your bank, your email and your admin panels. A cookie editor needs the tab in front of you and nothing else. Chrome has supported asking that way for years, and most of them still do not.
Does it sync my cookies anywhere? There is no sync, no backup and no account. Cookies are session tokens, so shipping them off the machine would be the single worst thing a tool like this could do.
Will editing a cookie log me out of everything? Only the site you edit, and only if you break its session cookie. It touches nothing else, which is a direct consequence of it only having access to one tab.
Free, and it stays free. No account, no sign-up, and nothing leaves your browser.
FAQ
Can I use this to stay logged in somewhere longer?
Sometimes. Extending a session cookie past its expiry works when the site trusts the cookie by itself. Plenty of sites also keep the session on their own server with their own timeout, and then you can hold a perfectly valid cookie for a session the server has already dropped. No extension can reach that half of it.
Is editing cookies safe?
For your own accounts on your own machine, yes, though you can log yourself out by mangling a session cookie. It is worth exporting before a big change. What it is not safe for is pasting in a cookie someone sent you, since that is how session hijacking works and you would be the target.
Why can I not see httpOnly cookies in the page itself?
Because httpOnly exists to stop exactly that. JavaScript running on the page cannot read those cookies, which is what keeps a session token out of reach of a cross-site scripting bug. This extension can still show them, since it asks the browser through its own cookie interface instead of reading anything off the page.
Does it sync my cookies anywhere?
No. There is no server involved at any point. Import and export write to and read from a file you choose.