The Netscape cookies.txt format
The format every command-line tool still speaks. One cookie per line, seven fields, separated by tabs — not spaces. Lines beginning with # are comments, with one deliberate exception.
# Netscape HTTP Cookie File
# https://curl.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
.example.com TRUE / TRUE 1798761600 session_id 8f14e45fceea167a5a36dedd4bea2543
#HttpOnly_.example.com TRUE / TRUE 1798761600 auth_token eyJhbGciOiJIUzI1NiJ9.e30.ZRrHA1JJJW8opsbCGfG_HACGpVUMN_a9IV7pAx_Zmeo
example.com FALSE /account FALSE 1798761600 theme dark
.example.com TRUE / FALSE 0 cart_preview tmp-4471The seven fields
| # | Field | Meaning | Values |
|---|---|---|---|
| 1 | domain | The host the cookie belongs to. A leading dot means it also applies to subdomains. | .example.com |
| 2 | includeSubdomains | Whether subdomains are included. Redundant with the leading dot, and readers disagree on which wins — we trust the dot. | TRUE or FALSE |
| 3 | path | The URL path the cookie is scoped to. | / or /app |
| 4 | secure | Whether the cookie is only sent over HTTPS. | TRUE or FALSE |
| 5 | expires | Expiry as a unix timestamp in seconds. Zero means a session cookie. | 1767225600 or 0 |
| 6 | name | The cookie name. | session_id |
| 7 | value | The cookie value, taken verbatim to the end of the line. It may contain = and ; freely. | abc123 |
The #HttpOnly_ prefix
The original format has no way to express an http-only cookie, so curl added one: prefix the domain with #HttpOnly_. Because the line then starts with a hash, readers that do not understand it treat it as a comment and skip it rather than choking. curl, wget and yt-dlp all understand it.
Things that catch people out
The separator is a tab. Pasting a file through a chat window or a web form frequently turns tabs into spaces, which breaks strict readers. This converter parses those files anyway and warns you.
The value runs to the end of the line, so it can contain = and ; without escaping. Splitting on those characters will corrupt JWTs and base64 values.
An expiry in the past is still a valid line. Tools will simply ignore the cookie, which looks identical to the cookie not being there at all.
Some writers omit the trailing tab when the value is empty, leaving six fields instead of seven.
Tools that use it
- curl
- curl -b cookies.txt to send, -c cookies.txt to save.
- wget
- --load-cookies and --save-cookies.
- yt-dlp
- --cookies cookies.txt, the usual reason for converting a browser export.
- Python requests
- Via http.cookiejar.MozillaCookieJar.
Try it in the converter
Converter