Skip to content
ENExplore Calculators

Cookie Security Calculator

Score a session cookie on Secure, HttpOnly, SameSite, prefix, scope, lifetime and rotation, and list the flags you are missing.

About Cookie Security Calculator

Secure and HttpOnly carry the most weight because they close the two ways a cookie leaves the browser without the user acting: a plaintext request and an injected script. SameSite is scored on a sliding scale, and the lifetime term rewards short sessions since it directly bounds how long a stolen cookie is worth stealing. Session cookies are the credential for the rest of the visit, so a missing flag converts a minor bug elsewhere — one mixed-content request, one XSS — into account takeover.

Formula

Cookie Security

Cookie score = 20 Secure + 18 HttpOnly + SameSite (20 Strict, 14 Lax, 4 None, 0 unset) + 8 __Host- prefix + 6 no Domain attribute + 4 path scoping + 12 rotation on login + lifetime score (12 at ≤1 h down to 0 above a week) = 100.

HttpOnly
Blocks document.cookie access from injected script
__Host-
Forces Secure, no Domain and path '/'

Worked example

With the default values below, Cookie Security Calculator returns Cookie Score of 69. Change any input above and every figure here is recalculated in your browser.

Inputs used

Secure flag set
Yes
HttpOnly flag set
Yes
SameSite attributeone of Strict — 20, Lax — 14, None with Secure — 4, Not set — 0
Lax — 14
__Host- prefix used
No
No Domain attribute, so no subdomain sharing
Yes
Path scoped to the application root or narrower
Yes
Rotated on login and privilege change
No
Cookie lifetimeaccepts 0.25–8,760 hours
24 hours

Results

Cookie Score
69 / 100
Cookie Grade
C — Fair
Missing Key Flags
__Host- prefix, rotation on login
Session Theft Exposure
Low — script and cross-site access are both blocked
Lifetime Assessment
Acceptable for a standard web session
Residual Exposure
31%

Step by step

  1. 1Values used
  2. 2Cookie Security
  3. 3Cookie Score= 69 / 100
  4. 4Cookie Grade= C — Fair
  5. 5Missing Key Flags= __Host- prefix, rotation on login
  6. 6Session Theft Exposure= Low — script and cross-site access are both blocked
  7. 7Lifetime Assessment= Acceptable for a standard web session
  8. 8Residual Exposure= 31

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Cookie Security calculated?

Cookie score = 20 Secure + 18 HttpOnly + SameSite (20 Strict, 14 Lax, 4 None, 0 unset) + 8 __Host- prefix + 6 no Domain attribute + 4 path scoping + 12 rotation on login + lifetime score (12 at ≤1 h down to 0 above a week) = 100. Secure and HttpOnly carry the most weight because they close the two ways a cookie leaves the browser without the user acting: a plaintext request and an injected script. SameSite is scored on a sliding scale, and the lifetime term rewards short sessions since it directly bounds how long a stolen cookie is worth stealing.

Why does Cookie Security matter?

Session cookies are the credential for the rest of the visit, so a missing flag converts a minor bug elsewhere — one mixed-content request, one XSS — into account takeover.

What values do I need to enter?

This calculator takes 8 inputs: Secure flag set, HttpOnly flag set, SameSite attribute, __Host- prefix used, No Domain attribute, so no subdomain sharing, Path scoped to the application root or narrower, Rotated on login and privilege change, Cookie lifetime. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

What does the __Host- prefix actually buy?

It makes the browser enforce the hardening for you: a cookie named __Host-session is only accepted if it is Secure, has no Domain attribute and has Path=/. That stops a compromised or attacker-controlled subdomain from overwriting your session cookie, which is a cookie-tossing attack that flags alone do not prevent.

Related Calculators

Cookie Security Calculator | Calcrivo