JSON cookie formats

There is no single JSON cookie format. Four shapes are in common use, and they store different amounts of information. This is what each one looks like and what it can hold.

What each format can store

Format	Domain	Expiry	Flags
Cookie-Editor and EditThisCookie	Yes	Yes	Yes
Puppeteer and Playwright	Yes	Yes	Yes
Key-value map	No	No	No
Cookie header string	No	No	No

The four shapes

Cookie-Editor and EditThisCookie

What the browser extensions export. The most complete of the four: it stores every attribute a browser cookie has, including hostOnly and the session flag. sameSite uses the words no_restriction, lax, strict and unspecified.

Used by — Cookie-Editor, EditThisCookie, Cookie Quick Manager

Domain: Yes
Expiry: Yes
Flags: Yes

Example

[
  {
    "domain": ".example.com",
    "expirationDate": 1798761600,
    "hostOnly": false,
    "httpOnly": false,
    "name": "session_id",
    "path": "/",
    "sameSite": "unspecified",
    "secure": true,
    "session": false,
    "storeId": "0",
    "value": "8f14e45fceea167a5a36dedd4bea2543"
  },
  {
    "domain": ".example.com",
    "expirationDate": 1798761600,
    "hostOnly": false,
    "httpOnly": true,
    "name": "auth_token",
    "path": "/",
    "sameSite": "unspecified",
    "secure": true,
    "session": false,
    "storeId": "0",
    "value": "eyJhbGciOiJIUzI1NiJ9.e30.ZRrHA1JJJW8opsbCGfG_HACGpVUMN_a9IV7pAx_Zmeo"
  },
  {
    "domain": "example.com",
    "expirationDate": 1798761600,
    "hostOnly": true,
    "httpOnly": false,
    "name": "theme",
    "path": "/account",
    "sameSite": "unspecified",
    "secure": false,
    "session": false,
    "storeId": "0",
    "value": "dark"
  },
  {
    "domain": ".example.com",
    "hostOnly": false,
    "httpOnly": false,
    "name": "cart_preview",
    "path": "/",
    "sameSite": "unspecified",
    "secure": false,
    "session": true,
    "storeId": "0",
    "value": "tmp-4471"
  }
]

Puppeteer and Playwright

What page.setCookie() and context.addCookies() accept. Expiry is called expires and uses -1 for session cookies. sameSite uses the HTTP spelling: None, Lax and Strict. Omitting sameSite lets the browser apply its own default, so we leave it out when it is unspecified.

Used by — Puppeteer, Playwright, Selenium wrappers

Domain: Yes
Expiry: Yes
Flags: Yes

Example

[
  {
    "name": "session_id",
    "value": "8f14e45fceea167a5a36dedd4bea2543",
    "domain": ".example.com",
    "path": "/",
    "expires": 1798761600,
    "httpOnly": false,
    "secure": true
  },
  {
    "name": "auth_token",
    "value": "eyJhbGciOiJIUzI1NiJ9.e30.ZRrHA1JJJW8opsbCGfG_HACGpVUMN_a9IV7pAx_Zmeo",
    "domain": ".example.com",
    "path": "/",
    "expires": 1798761600,
    "httpOnly": true,
    "secure": true
  },
  {
    "name": "theme",
    "value": "dark",
    "domain": "example.com",
    "path": "/account",
    "expires": 1798761600,
    "httpOnly": false,
    "secure": false
  },
  {
    "name": "cart_preview",
    "value": "tmp-4471",
    "domain": ".example.com",
    "path": "/",
    "expires": -1,
    "httpOnly": false,
    "secure": false
  }
]

Key-value map

A flat object of names to values. This is what you hand to a requests session or an axios config. It stores nothing else at all — no domain, no expiry, no flags.

Used by — Python requests, axios, fetch wrappers

Domain: No
Expiry: No
Flags: No

Example

{
  "session_id": "8f14e45fceea167a5a36dedd4bea2543",
  "auth_token": "eyJhbGciOiJIUzI1NiJ9.e30.ZRrHA1JJJW8opsbCGfG_HACGpVUMN_a9IV7pAx_Zmeo",
  "theme": "dark",
  "cart_preview": "tmp-4471"
}

Cookie header string

Not JSON, but it belongs in the same conversation: the literal value of a Cookie request header. Pairs joined by a semicolon and a space. This is what you paste after curl -H or into Postman.

Used by — curl, Postman, HTTPie, browser DevTools

Domain: No
Expiry: No
Flags: No

Example

session_id=8f14e45fceea167a5a36dedd4bea2543; auth_token=eyJhbGciOiJIUzI1NiJ9.e30.ZRrHA1JJJW8opsbCGfG_HACGpVUMN_a9IV7pAx_Zmeo; theme=dark; cart_preview=tmp-4471

Converting between them loses information

Going from a complete format to key-value or a header is one-way: the domain, path, expiry and flags have nowhere to be stored. Converting back gives you session cookies with whatever domain you supply. The converter warns you when a conversion would drop data.

Try it in the converter

Converter

Need the same conversion from a script? Netscape, Cookie-Editor, Puppeteer, key-value and Cookie headers are on the public JSON API. API documentation