Free online tool
Trim a cookies.txt export to only the domains you need
Drop a cookies.txt export and trim it to the minimum needed: the tool lists every cookie by domain, so you can keep only the domains a bug reproduction actually needs and drop session cookies, expired entries, and unrelated domains. The cleaned file downloads in the same valid Netscape format, with a count of everything removed. The file never leaves your browser — but a trimmed cookies.txt still contains real session cookies for the domains you keep, so never share it publicly.
Quick answer
Quick answer
Drop a cookies.txt export and this tool lists its cookies by domain, in your browser. Keep only the domains you need for a bug reproduction, drop session cookies, expired entries and unrelated domains, then download a Netscape-format file with a count of everything removed. Nothing is uploaded — but kept cookies still grant access, so never share the file publicly.
Open the interactive cookies.txt Scrubber
The interactive tool loads in the page. Enable JavaScript to enter data, process content, and download results.
Worked example — the built-in sample
The built-in sample with only .example.com kept and both drop toggles on.
| File | sample-cookies.txt |
|---|---|
| Cookies found | 5 across 3 domains |
| Kept | 2 — pref and cart on example.com |
| Removed | 3 — 1 expired, 1 session, 1 third-party |
What the scrubber removes
| Reason | What it removes | When it applies |
|---|---|---|
| Third-party domain | Every cookie from a domain you did not keep | You untick a domain |
| Expired | Cookies whose expiry timestamp is in the past | Drop expired is on |
| Session | Cookies with an expiry of 0 | Drop session is on |
| Malformed | Lines that are not 7 tab-separated fields | Always, at parse time |
The 7 Netscape fields
| Field | Example | Meaning |
|---|---|---|
| Domain | .example.com | The cookie belongs to this domain and its subdomains |
| Flag | TRUE | The cookie is sent to subdomains |
| Path | / | The cookie is sent for this path and below |
| Secure | FALSE | FALSE means plain HTTP too; TRUE means HTTPS only |
| Expiry | 1900000000 | Unix timestamp; 0 means a session cookie |
| Name | pref | The cookie name |
| Value | light | The cookie value |
About this tool
About the cookies.txt Scrubber
Drop a cookies.txt export and trim it to the minimum needed: the tool lists every cookie by domain, so you can keep only the domains a bug reproduction actually needs and drop session cookies, expired entries, and unrelated domains. The cleaned file downloads in the same valid Netscape format, with a count of everything removed. The file never leaves your browser — but a trimmed cookies.txt still contains real session cookies for the domains you keep, so never share it publicly.
Detailed guide
How to get useful results from cookies.txt Scrubber
What a cookies.txt file is
A cookies.txt file is the Netscape export format used by curl, wget, and yt-dlp: one cookie per line, with seven tab-separated fields — domain, a flag for subdomains, path, a secure flag, an expiry timestamp, the cookie name, and its value. An expiry of 0 means a session cookie, which lives only until the browser closes. Browser extensions export this format so command-line tools can make requests as if they were your browser.
That is also what makes the file dangerous to share. It is not a settings file — it is a set of live logins. Anyone who holds a copy can send requests as you on every site in it, until those cookies expire or are revoked. Guides for sharing cookie files in bug reports warn about this in plain terms, which is why a tool for trimming the file has to carry the warning on its face, not in a footnote.
Why a shared cookies.txt is dangerous
Cookie files are routinely pasted into support threads, bug reports, and tutorials so someone else can reproduce a failing request. The person sharing usually wants the helper to see one site — but the exported file often holds every site they were signed into: mail, banking, social accounts, work tools. A session cookie maps directly to a signed-in account, and there is no password prompt between holding the file and using it.
Trimming the file to one domain shrinks that exposure, but it does not remove it. The kept cookies still grant access to the kept accounts. That is the honest limit of this tool, and the reason the page warns against sharing the file publicly at all: the safest share is a throwaway account created only for the reproduction, with its password changed afterwards.
How the scrubber reads the file
The tool reads the file with the File API and parses it line by line, in your browser tab. Comment lines starting with # and blank lines are skipped. Every other line must have exactly seven tab-separated fields, a non-empty domain and cookie name, and an expiry that is a whole number of 0 or more — anything else is counted as a malformed line and skipped, so a stray line cannot corrupt the output.
Each cookie is then checked against your choices: is its domain kept, is it expired, is it a session cookie. A cookie can only be removed for one reason, in a fixed order — third-party domain first, then expired, then session — so the counts in the report always add up to the total removed. The cleaned file is re-parsed before the download appears, and the download is offered only if the re-check passes.
Choosing which domains to keep
After the file loads, the tool lists every domain it found, with a cookie count beside each one. All domains start kept, so nothing is dropped by surprise — you untick the ones that do not belong in the reproduction. For a bug report about one site, that usually means keeping a single domain and unticking everything else, including trackers and unrelated sites that happened to be in the same export.
Domain matching is by suffix: keeping .example.com also keeps www.example.com and api.example.com, because those are the same site. Keeping example.com does not keep notexample.com — the match only works on a dot boundary, so a lookalike domain cannot slip through. The built-in sample shows this: keeping only .example.com keeps the pref and cart cookies and drops the tracker domain entirely.
Session cookies and expired entries
A session cookie has an expiry of 0 — it lives only until the browser closes, and it is the most powerful cookie in the file, because it is the one that proves you are signed in right now. The drop-session toggle is on by default, so session cookies are removed unless you deliberately turn it off. If a reproduction genuinely needs a live session, keep the toggle off — and use a throwaway account for it.
Expired cookies are the opposite: their timestamp is in the past, so no server will accept them, and they only add noise to a shared file. The drop-expired toggle is on by default and removes them. Turning both toggles off keeps everything from the kept domains, expired and session cookies included — the tool never forces a removal you did not ask for.
What the cleaned file looks like
The cleaned file is a valid Netscape-format cookies.txt: a # Netscape HTTP Cookie File header, then one line per kept cookie with the same seven tab-separated fields, in the same order, byte-identical to the originals. Curl, wget, and yt-dlp read it exactly the way they read the original export, so the reproduction still works — the request just carries fewer cookies.
The built-in sample makes the arithmetic concrete. It holds five cookies across three domains: a preference cookie and an old token on .example.com, a session cookie, a cart cookie on www.example.com, and a tracker cookie on .tracker.example.net. Keep only .example.com with both toggles on and the tool keeps 2 cookies — pref and cart — and removes 3: 1 expired, 1 session, and 1 third-party.
What scrubbing cannot do
Scrubbing cannot make a shared cookie safe. A kept session cookie still grants access to that account, and anyone with the file can use it until it expires or is revoked. Scrubbing also cannot tell whether a kept cookie still works — an expired or revoked session stays expired no matter how the file is trimmed, so test the cleaned file against the real request before you share it.
Two format limits are worth knowing. The Netscape format has no HttpOnly column, so that attribute is not preserved in the cleaned file — the cookie name and value are identical, but the HttpOnly flag is lost. And the cleaned file drops the original export's comment lines, so any notes the exporter wrote at the top are not carried over. This version handles one cookies.txt file at a time, up to 5 MB.
Quick guide
How to use this tool
- 01Drop a cookies.txt file onto the upload area, or browse to choose one — up to 5 MB.
- 02Read the domain list and untick every domain the reproduction does not need.
- 03Leave the drop-expired and drop-session toggles on, or turn them off if the reproduction needs those cookies.
- 04Press Scrub cookies and read the counts — kept, and removed by reason.
- 05Download the cleaned cookies.txt and use it with curl, wget, or yt-dlp.
Capabilities
Features and supported formats
- Parses Netscape-format cookies.txt exports — domain, flag, path, secure, expiry, name, value — and skips comment and malformed lines with a count.
- Lists cookies by domain with keep checkboxes, so you keep only the domains a bug reproduction needs.
- Drops session cookies (expiry 0) and expired entries with separate toggles, each on by default.
- Matches domains by suffix, so keeping .example.com also keeps www.example.com — without letting lookalike domains slip through.
- Re-parses the cleaned file before download, so the output is always a valid 7-field Netscape file.
- Runs 100% in your browser; the file is never uploaded, stored, or shared.
Supported formats
Input: one cookies.txt file (Netscape format), up to 5 MB. Output: a cleaned cookies.txt in the same valid Netscape format — header plus one 7-field line per kept cookie — with a count of kept and removed cookies by reason.
Answers
Frequently asked questions
Does the cookies.txt Scrubber upload my file?
No. The file is read with the File API and parsed only in your browser tab. Nothing is sent to a server, and no cookie value ever leaves your device.
What is the Netscape cookies.txt format?
One cookie per line, with seven tab-separated fields: domain, a flag for subdomains, path, a secure flag, an expiry timestamp, the cookie name, and its value. Curl, wget, and yt-dlp all accept this format, which is why browser extensions export it.
What does an expiry of 0 mean?
It is a session cookie: it lives only until the browser closes, and it is the cookie that proves you are signed in right now. The drop-session toggle is on by default because session cookies are the most powerful cookies in the file.
How do I choose which domains to keep?
After the file loads, every domain appears in a list with a cookie count beside it. All domains start kept, so nothing is dropped by surprise — untick the ones the reproduction does not need, such as trackers and unrelated sites.
Does keeping .example.com keep www.example.com?
Yes. Domain matching is by suffix, so keeping .example.com also keeps www.example.com and api.example.com. It does not keep notexample.com — the match only works on a dot boundary, so a lookalike domain cannot slip through.
What happens to expired cookies?
Cookies whose expiry timestamp is in the past are removed when the drop-expired toggle is on, which is the default. Their server will not accept them anyway, so they only add noise to a shared file.
What happens to malformed lines?
Lines that are not exactly seven tab-separated fields, or that have an empty domain or name or a non-numeric expiry, are skipped and counted as malformed. They never reach the cleaned file, and the count is shown in the results.
Can I still use the cleaned file with curl, wget, or yt-dlp?
Yes. The cleaned file is a valid Netscape-format cookies.txt — the same header and the same seven fields per line, with kept cookies byte-identical to the originals. It works in any tool that reads the original export.
Is the cleaned file safe to share publicly?
No. Every cookie you keep still logs whoever holds the file into that account, session cookies most of all. Never post a cookies.txt in a public bug report, chat, or forum. If you must share one, use a throwaway account created only for that reproduction and change its password afterwards.
What is the file size limit?
One cookies.txt file at a time, up to 5 MB. Larger files are refused before any reading starts, so a huge file cannot freeze your tab.
Does scrubbing remove the HttpOnly flag?
The Netscape format has no HttpOnly column, so that attribute is not preserved in the cleaned file. The cookie name and value are identical to the original — only the flag is lost, because the format has nowhere to store it.
Can I use it on my phone?
Yes. The file picker works on mobile browsers, and the whole scrub runs in the tab. Pick the cookies.txt from your downloads and the domain list appears in seconds.