Free Online Cookie Expiry Calculator
Calculate cookie expiration dates and Set-Cookie headers.
Cookie details
86,400 seconds equals 1 day.
Times are shown in your device's local time zone. The Set-Cookie preview uses the GMT format required by HTTP. Browser behaviour and server rules may differ, so test the final header on your own stack.
About the Cookie Expiry Calculator
Cookies are small pieces of state that a browser sends back to a site on later requests. Their lifetime can be set in two ways: a relative Max-Age in seconds, or an absolute Expires date. This tool converts between those forms and shows the exact moment a cookie stops being valid. Enter the moment the cookie is created, then either a Max-Age or a fixed expiry. The result includes the local expiry time, the UTC time used in the HTTP header, the remaining days and hours, and a complete Set-Cookie preview with common attributes such as Path, Secure, HttpOnly, and SameSite.
The preview is useful when debugging session cookies, consent preferences, or tracking cookies. A common mistake is setting Max-Age in milliseconds instead of seconds, which makes a cookie vanish almost instantly. Another is setting a date in the past, which tells the browser to delete the cookie. The remaining-time figure makes both mistakes obvious. The calculator is purely local: the name and value you type are not sent anywhere, and no cookie is created by the page.
Max-Age versus Expires
- Max-Age is a number of seconds relative to the moment the browser receives the header. It is not affected by clock differences between the server and the client.
- Expires is an absolute HTTP date. It depends on the client clock being roughly correct and is written in GMT.
- Both present: browsers give Max-Age priority. The preview includes both when you calculate from Max-Age so the header remains readable and compatible.
- Session cookies: a cookie with neither attribute lasts until the browser session ends. This tool always produces a persistent cookie.
Choosing sensible attributes
Secure prevents the cookie from being sent over plain HTTP and should be used on every production site. HttpOnly hides the cookie from JavaScript, which reduces the impact of cross-site scripting but also means client-side code cannot read it. SameSite controls whether the cookie is sent on cross-site requests. Lax is a practical default for many sites; Strict is stronger but can break inbound links; None is required for some cross-site embeds and must be paired with Secure. Path limits which URLs receive the cookie, and Domain widens it to subdomains. Narrow scope is safer than a broad one.
Expiry is only one part of cookie hygiene. Cookies that identify a person or store consent should match your privacy notice and retention policy, and session identifiers should be rotated after login. This calculator does not create, inspect, or delete cookies, and it does not validate whether a lifetime is lawful or appropriate for your jurisdiction. Treat the output as an informational estimate, not legal advice, and confirm the final header with your framework, browser developer tools, and legal or security advisers where needed.
Frequently asked questions
Why does the remaining time differ from Max-Age?
Max-Age is measured from creation, while the remaining figure is measured from the current moment. If the cookie was created in the past, less time is left than the original Max-Age. A negative value means the expiry has already passed.
Is the Set-Cookie header ready to use?
It is a valid preview for the values you enter, but real deployments often add a Domain, a specific Path, or a signed value. Copy the structure and adapt it in your server code rather than pasting a secret into a public page.
Does this page set a cookie?
No. The tool only performs date arithmetic in your browser. It does not write cookies, call a server, or store the cookie name and value you type.