Cookiebot, from Usercentrics, is one of the best-known cookie consent management platforms. It crawls a site over multiple pages on a schedule, discovers every cookie it can find -- yours and any third party's -- and classifies each one into a consent category (necessary, preferences, statistics, marketing) so the site can show a GDPR/ePrivacy-compliant consent banner and publish an auto-generated cookie declaration page. That is a compliance and disclosure job: which cookies exist, and what is each one for.
This checker does a completely different, much narrower job. It is a single zero-dependency Node
CLI: node check.mjs <url> --json sends one request to a URL you
choose and reads the response's raw Set-Cookie headers -- not what the cookie is
for, but whether it is configured the way current browsers actually require.
It flags SameSite=None without Secure (which Chrome, Firefox, and Safari
all reject outright, not just weaken), a __Host-/__Secure- prefixed cookie
that violates the attribute rules those prefixes demand (also silently rejected), and notices for a
missing Secure, missing HttpOnly, or missing SameSite
attribute. It has no crawler, no consent-category concept, and no banner -- the browser page here
only renders a report from JSON you already have.
| What you are trying to do | Where to do it |
|---|---|
| Show a GDPR/ePrivacy-compliant consent banner and publish a cookie declaration listing every cookie the site sets and why. | Cookiebot -- that is its core product. |
| Discover cookies set by third-party scripts anywhere on the site, including ones that only appear days into a session. | Cookiebot -- continuous multi-page crawling is what finds those. |
Know whether a specific cookie's Secure/HttpOnly/SameSite attributes and __Host-/__Secure- prefix are set the way the browser actually requires, so the cookie isn't silently dropped. |
This checker -- that is the one thing it checks, in detail. |
Gate a deploy in your own CI on a SameSite=None-without-Secure or broken-prefix regression, with an exit code, at zero cost. |
This checker -- node check.mjs <url> exits non-zero on a danger finding. |
| Get a legally defensible record of consent-category classification for a data protection audit. | Cookiebot -- this checker has no concept of consent purpose at all. |
| Check a single response without an account, a subscription, or any third party's crawler ever touching the site. | This checker -- free, local, one request, nothing uploaded. |
These compose rather than compete, and a site handling real user data plausibly wants both: Cookiebot for the consent banner and legal disclosure obligation, and this checker wired into CI so a regression in the specific browser-enforced attribute rules it covers turns a build red the day it lands, instead of being noticed later (or never) as cookies quietly failing to persist for some fraction of users. Neither tool replaces the other -- they are not answering the same question.
They answer different questions and most sites that need one eventually need both. Cookiebot crawls your site across multiple pages, finds every cookie (yours and any third party's) it can discover, and classifies each one by consent purpose -- necessary, preferences, statistics, marketing -- so you can show a legally compliant consent banner and publish a cookie declaration page, which is a GDPR/ePrivacy compliance job. This checker does not crawl anything and has no concept of consent categories: it sends one request to one URL, reads the raw Set-Cookie header the response actually carries, and reports whether that header is configured the way the current browser specifications require -- SameSite=None with Secure, a __Host-/__Secure- prefix cookie meeting the attribute rules those prefixes demand, Secure, HttpOnly, and SameSite present. Reach for Cookiebot to build a consent banner and cookie policy; reach for this to know whether a specific cookie will actually be stored by the browser or silently dropped.
Because listing a cookie for consent purposes and checking whether the browser will honour its security attributes are unrelated facts about it. Cookiebot's scan tells you a cookie named session exists and which consent category it falls into; it does not tell you that the same cookie is SameSite=None without Secure, which every current major browser rejects outright -- the cookie Cookiebot catalogued for your consent banner may never actually reach the browser's cookie jar at all. This checker reads exactly that: the raw Set-Cookie header, classified against the browser-enforced attribute rules, independent of what the cookie is for.
Because the two tools are solving different-shaped problems. A consent-compliance scan needs to discover every cookie anywhere on the site, including ones set by third-party scripts days into a session, which is why Cookiebot crawls continuously. A Set-Cookie security check is a property of one response at a time -- does this specific header meet the attribute rules the browser enforces -- so a single request against the endpoint you care about is enough to answer it, and a small local CLI you run yourself (or wire into CI) answers it without a subscription, an account, or a third party's crawler ever touching your site.
Cookiebot offers a free tier for a single domain with usage limits, alongside paid plans for more domains, more page scans, and consent-management features -- see Cookiebot's own site for current pricing and limits, which this page does not track. This checker is free and open source under an MIT licence with no tiers, no account, and no usage limits of its own; being free is not really the distinguishing question here, though -- the tools check different things regardless of price.
No. This site is not affiliated with, endorsed by, or sponsored by Cookiebot or its parent company Usercentrics, named here only to describe what this checker is and is not. What Cookiebot currently scans and how its consent platform works are described on its own site -- check there for what it covers today.
Only point either tool at a system you own or are authorised to test. That rule is unchanged by which one you pick.