Skip to content
uencoder
TASK

Use cookies securely

Cookies must be set with Secure, HttpOnly, SameSite, and proper expiration. Learn cookie attributes and security best practices.

  1. 1

    Cookie security attributes: Secure (only sent over HTTPS), HttpOnly (not accessible via JavaScript — prevents XSS theft), SameSite (Lax/Strict/None — controls cross-site sending, prevents CSRF), Domain (scope), Path (scope), Max-Age/Expires (lifetime), Partitioned (CHIPS — per-top-level-site). For session cookies: Secure + HttpOnly + SameSite=Lax + short Max-Age.

  2. 2
    Base64 Encoder →

    Encode cookie values as base64 if they contain binary data or special characters. This ensures the cookie value is a valid cookie string (no spaces, semicolons, or commas). The server decodes base64 to recover the original value. For JSON cookies, encode the JSON string as base64.

  3. 3
    HMAC Generator →

    Sign cookies with HMAC to prevent tampering. The cookie value is: data + "." + HMAC(secret, data). On receipt, verify the HMAC before trusting the data. This allows stateless session cookies — the session data is in the cookie (signed, not encrypted), and the server verifies the signature without a database lookup.

Frequently asked questions

When to use HttpOnly?
Always, for cookies that the browser needs but JavaScript does not (session IDs, CSRF tokens). HttpOnly prevents XSS from stealing the cookie via document.cookie. The only exception is cookies that JavaScript must read (e.g., a theme preference) — but these should not be security-sensitive.
SameSite=Lax vs Strict vs None?
Lax (default): cookies sent on top-level navigations (link clicks, form GET) but not on cross-site POST or iframes — prevents CSRF for most cases. Strict: cookies only sent for same-site requests — strongest but breaks cross-site links (user follows a link to your site, no cookies sent, appears logged out). None: always sent (requires Secure) — needed for third-party cookies (iframes, embeds).

Workflows that solve this

Convert Ascii85 to Base64
Decode Ascii85 and re-encode as Base64 for wider compatibility.
PIPELINE
Convert Base2048 to Base64
Decode Base2048 (emoji) and re-encode as Base64 for standard transport.
PIPELINE
Convert Base32 to Base64
Decode a Base32-encoded string into raw bytes and re-encode as Base64 for more compact representation.
PIPELINE
Convert Base58 to Base64
Decode Base58 and re-encode as Base64 for standard compatibility.
PIPELINE
Base64 encode then decode round-trip
Encode text to Base64 and decode it back to verify the round-trip preserves the original data.
PIPELINE
Blowfish Encrypt then Base64
Blowfish encrypt then Base64-encode for text-safe transport.
PIPELINE
DES Encrypt then Base64
DES encrypt then Base64-encode for legacy compatibility.
PIPELINE
Encode a JSON payload for URL transport
Prepare a JSON document for a URL parameter: pretty-print, Base64-encode, then percent-encode — the exact inverse of the nested-parameter decode chain.
PIPELINE
AES encrypt then Base64 encode
Encrypt plaintext with AES and encode the ciphertext as Base64 for text-safe transport.
PIPELINE
Hash content and encode as Base64
Compute a hash of the input and encode the hash digest as Base64 for compact transport.
PIPELINE
Convert Hex to Base64
Decode a hexadecimal string into raw bytes and re-encode it as Base64 for compact transport.
PIPELINE
HMAC Sign then Base64 Encode
Generate HMAC signature then Base64-encode for API auth headers.
PIPELINE
HMAC sign and verify
Generate an HMAC signature for a message and verify it against an expected signature.
PIPELINE
HMAC-sign an API request string
Generate an HMAC-SHA256 signature for a request payload to authenticate API calls.
PIPELINE
Morse Encode and Base64 Transport
Encode text as Morse code then Base64-encode for digital transport.
PIPELINE
RC4 Encrypt then Base64
RC4 encrypt then Base64-encode for transport.
PIPELINE
RIPEMD-160 Hash then Base64
Compute RIPEMD-160 hash then Base64-encode for transport.
PIPELINE
Shuffle Text and Base64 Encode
Shuffle text characters then Base64-encode the result.
PIPELINE
Unicode Escape and Base64 Encode
Unicode-escape text then Base64-encode for ASCII-safe transport.
PIPELINE
URL Encode then Base64 Double Encode
URL-encode then Base64-encode for double encoding in API payloads.
PIPELINE
UUencode then Base64
UUencode text then Base64-encode the result for double encoding.
PIPELINE
Generate UUID and Base64 Encode
Generate a UUID then Base64-encode it for compact storage.
PIPELINE

Learn more

Want to understand why?

Base64 vs Base32 vs Base58
Compare three popular base-encoding schemes and learn when to choose each one.
TUTORIAL
Base64: how it works and when to use it
The byte-to-character mechanics behind Base64, why padding exists, which alphabet variants you will meet, and the boundaries where Base64 is the wrong tool.
TUTORIAL
Base128
Base128 maps binary data onto 128 ASCII characters, carrying 7 bits of payload per byte for an expansion of about 8/7.
GLOSSARY
Base64
Base64 maps arbitrary binary data onto 64 printable ASCII characters (A-Z, a-z, 0-9, +, /) so that binary data can travel over text-only channels.
GLOSSARY

Related tools

Base64 Encoder
Encode text or binary data to Base64 online. Free, private, and 100% client-side.
TOOL
HMAC Generator
Generate HMAC (Keyed-Hash Message Authentication Code) with SHA-1/256/512. Free, private, and 100% client-side.
TOOL
Hash Calculator
Compute MD5, SHA-1, SHA-256, or SHA-512 hashes with hex or Base64 output. Free, private, and 100% client-side.
TOOL