Paste the Cookie request header as it comes out of DevTools and you get a flat JSON object back. Cookie → JSON splits on semicolons and treats the first = in each piece as the divider, so token=a=b survives as one value. It runs in your browser, needs no signup, caps input at 2,000,000 characters, and reads the request header only — a Set-Cookie line will stop it.
The case I keep hitting: a request works in the browser and 401s in Postman. I copy the Cookie value off the Network tab to see which key the session actually rides on.
Copy, paste, run — in that order
- DevTools → Network → the request → Headers → Request Headers → copy the
Cookievalue. - Paste it in. A leading
Cookie:is stripped, case-insensitively. - Run tool. Out comes read-only JSON, 2-space indent, keys in first-seen order. Copy result.
What makes the whole run fail?
One bad pair kills the entire conversion, and the error never says which piece was wrong.
| Paste | Result | Reason |
|---|---|---|
theme=light; token=a=b | {"theme":"light","token":"a=b"} | only the first = splits |
a=1; a=2 | {"a":["1","2"]} | duplicates become an array |
a=1; Secure; Path=/ | error | a piece without = aborts everything |
name="a;b" | error | quotes do not shield a semicolon |
a=1 newline b=2 | {"a":"1\nb=2"} | only semicolons separate |
Keys cannot contain spaces, which is why a stray space before Cookie: breaks it: the key becomes Cookie: a. Values are trimmed but never decoded, so %E4%B8%AD stays encoded and Base64 padding stays as written.
I tested those rows by lifting the page’s own splitting function and running it locally on a dozen odd inputs.
When is it the wrong tool?
A Set-Cookie response header is the main trap: Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/; HttpOnly carries attributes with no =, so it dies on the first one. The options row is empty too — no sorting, no nesting, no filtering — and Load file takes only 12 text extensions (.txt .json .csv .tsv .xml .html .css .js .sql .md .yaml .yml), so a .har will not open.
Right job: one request Cookie header turned into flat JSON you can eyeball or diff. Wrong job: Set-Cookie, nesting, or anything needing URL decoding.
For the plain request header, Cookie → JSON on ToolPug does it in one paste, offline, without an account.
Written by: someone who spends too much time comparing session cookies between two test accounts
Last updated: 15 November 2026
Sources: the tool page itself, its example input and output, and the splitting rules re-run locally on the page’s own function
Features and parameters follow the version of this tool page on toolpug.com as of November 2026.