Free tools / Cookie scanner
Cookie scanner
Paste a URL. This loads the page in a real browser — not just a plain fetch — and lists every cookie it actually sets: first-party or third-party, session or persistent, and which vendor it belongs to where we recognize one.
Total cookies
0Third-party
0Persistent
0| Cookie | Domain | Type | Vendor | Expiry |
|---|
Why a real browser, not just a request
A plain HTTP fetch only sees cookies set via the response's
Set-Cookie header. In practice, most tracking cookies are
set by JavaScript running after the page loads — an analytics
snippet, a chat widget, an ad pixel, a consent-management platform
that's supposed to be blocking them and isn't. Anything that only
reads response headers will systematically undercount, often by a
lot. This scanner runs the page in an actual browser and reads back
what's really there.
What "first-party" and "third-party" actually tell you
First-party cookies are the site managing its own state — logins, preferences, that kind of thing. Third-party cookies are where the privacy questions live: a cookie whose domain belongs to an ad network or analytics vendor, set while you were on someone else's page, is how cross-site tracking works. The count that matters most for a compliance review is usually third-party persistent cookies set before any consent action — those are the ones a banner exists to prevent, and this scan runs without clicking through any banner, so it shows exactly that baseline.
What to do with the result
A long list of third-party cookies is usually a proxy for a long list of third-party scripts — see the tracking script checker for the script-level view of the same problem, including page-weight. UserTapes itself sets none of this: no cookies, no fingerprinting, inputs masked at the source — see the cookieless privacy page for how that's actually built, not just claimed.
FAQ
How does this cookie scanner work?
It loads the page you paste in inside a real headless browser (not just a plain HTTP request), lets its JavaScript run, and reads back every cookie set once the page settles. Most tracking cookies are set by JavaScript after the initial page load, so a tool that only reads response headers would miss most of what's actually happening.
What's the difference between first-party and third-party cookies?
A first-party cookie's domain matches the site you're on. A third-party cookie's domain belongs to someone else — an ad network, an analytics vendor, a session-replay tool — set while you were on the page you're auditing. Third-party cookies are usually the ones a consent banner exists to gate.
Does this show cookies set before or after consent?
Before. The scan doesn't click through any consent banner, so what you see is what the page sets on arrival, by default — often the actual compliance question worth asking, since a banner that still sets tracking cookies before you click anything isn't doing its job.
Does this tool store or display cookie values?
No — it shows the cookie's name, domain, type and expiry, never its value. Values can carry session data and aren't useful for this kind of audit anyway.