Bokal

Bokal › edit httponly cookies chrome

How to view and edit HttpOnly cookies in Chrome

JavaScript cannot see them by design. DevTools can, but awkwardly. Here is what HttpOnly actually does, and the fastest way to read and change one.

Last updated 26 August 2026.

What HttpOnly means

A cookie marked HttpOnly is sent with HTTP requests as normal but is hidden from JavaScript. Reading document.cookie in the console will not show it, and no script on the page can read or overwrite it.

That is a deliberate defence against cross-site scripting: if an attacker manages to run JavaScript on your page, an HttpOnly session cookie is one thing they still cannot simply read out. It is why almost every framework sets its session cookie that way — connect.sid, PHPSESSID, JSESSIONID, Django's sessionid and Rails' _session_id are all normally HttpOnly.

The practical consequence: any cookie tool built on document.cookie — which includes a lot of bookmarklets, snippets and simpler extensions — is structurally blind to exactly the cookies you most often need to debug. To touch them, a tool has to go through the browser's own privileged cookie API.

Option 1 — Chrome DevTools

DevTools can do this, and it is worth knowing since it needs nothing installed:

  1. Open DevTools

    F12, or ⌥⌘I on macOS.

  2. Application → Storage → Cookies

    Pick the origin in the left-hand tree. Every cookie appears, including HttpOnly ones, with an HttpOnly checkbox column.

  3. Double-click a cell to edit

    Value, Domain, Path, Expires and the flags are all editable in place. Refresh the page for the change to take effect on the next request.

Where this gets tiring: the table is cramped, there is no search across sites, editing an expiry means typing a date string in the right format, and you cannot save a set of cookies to restore later. For a one-off change it is fine. For repeated session work it is a lot of clicking.

Option 2 — Bokal

Bokal goes through Chrome's cookies API, so HttpOnly cookies are first-class:

  1. Open Bokal on the site

    Click the toolbar icon and grant access to that one site. Bokal asks only for the origin you are on — it declares no site access at install and no tabs permission.

  2. Find the cookie

    Search and filter across the site's cookies, or switch to the all-sites view. Audit badges flag missing SameSite, unpartitioned cross-site cookies and oversized values inline.

  3. Edit it

    Name, Value, Domain, Path, Expires, and the HttpOnly, Secure, Host-only and SameSite flags — with a session-cookie toggle so you do not have to hand-craft an expiry.

There is also a DevTools panel if you would rather stay in that window, and export to JSON, Netscape, cookie-header, Playwright and Puppeteer formats when you need the session somewhere else.

Things that bite people

Handle session cookies like credentials. A copied HttpOnly session cookie is the login. Anyone holding it can act as you on that site until it expires. Do not paste one into a ticket, a chat or a repository, and prefer a throwaway test account.

Frequently asked

Why can't I see HttpOnly cookies in document.cookie?

That is exactly what the flag does — it hides the cookie from all JavaScript on the page so that an XSS bug cannot read your session token. Use DevTools or an extension that goes through the browser's cookie API.

Can an extension read HttpOnly cookies?

Yes, if it has the cookies permission and host access for that origin. That is a lot of trust to hand over, which is why it is worth checking what a cookie extension requests at install — see our notes on what to check.

Does editing a cookie log me in as someone else?

Only if you already hold a valid session value for that account. Pasting in an arbitrary string will not forge a session — the server validates it.

Try Bokal

Free and open source (GPL-3.0). No account, no telemetry, no install-time site access.

Add to Chrome Read the source