b2KIT

Third-Party Cookie Tester

Test whether your browser blocks third-party cookies. Explains implications for tracking and privacy.

Tested tool guide Tested browser tools Checked August 16, 2026

What Third-Party Cookie Tester does, with a checked example

This tool runs a live round trip in your browser: the page asks a second site, on a different registrable domain, to set a cookie, then asks that same site whether the cookie came back on a follow-up request. If it did, your browser accepts third-party cookies; if not, it is blocking them. The result is a snapshot of this browser at this moment. The common surprise: 'third-party' means only that the cookie's domain differs from the page's, not that it is malicious, and browsers disagree sharply - Safari and Firefox block cross-site cookies by default while Chrome still allows them.

Worked example

A concrete input and expected output from the current implementation.

Input

No text is needed: click Run test in the browser you want to check, for example Safari with default settings.

Expected output

Third-party cookies: BLOCKED. The test site set a cookie from a cross-site request, and the read-back request came back empty, so this browser refused the cross-site cookie.

Safari blocks third-party cookies by default, so the cookie the test's second domain sets never survives to the read-back request, and the tool reports the block.

How the result is produced

1

The cross-site round trip

The page drives the test itself. It triggers a request to a second registrable domain the tool controls, which responds with a cookie scoped to that domain. Because browsers default unmarked cookies to SameSite=Lax, which is never sent on cross-site subresource requests, the test cookie must carry an explicit SameSite=None; Secure to be eligible. The page then asks that second domain to report whether the cookie came back; an empty echo means the browser blocked it.

2

Reading the verdict

The verdict describes one browser profile at one moment. Safari and Firefox block cross-site cookies by default; Chrome still allows them, since Google shelved its plan to remove them in 2024 and has been rolling out a consent prompt instead. Enterprise policy, privacy extensions, and incognito mode can all flip the result, so treat the verdict as evidence about this browser, not about browsers in general.

Good uses

  • Debug a broken embedded widget: if a chat bubble, payment frame, or analytics tag loses state or fails to recognize a returning visitor, run the test first to see whether the browser is refusing cross-site cookies before you blame the widget's code.
  • Compare profiles: check whether incognito mode, an enterprise-managed browser, or a browser with privacy extensions behaves differently from your default profile, which helps when a customer reports behavior you cannot reproduce.
  • Scope a feature that needs cross-site state: if your site relies on a cookie set by an embedded third-party service, test the browsers your users actually run to learn whether that channel is available at all, and plan a fallback if it is not.

Limits and checks

  • Not a privacy score: a blocked verdict removes one tracking channel, but first-party cookies, login state, IP address, and device fingerprinting still work, so it does not measure how private the browser is overall.
  • A snapshot, not a rule: the verdict reflects this profile at this instant. Extensions, enterprise policy, a VPN, or a browser update can change it, and other browsers on other machines can differ, so do not generalize from a single run.
  • The test only sees its own domains: it exercises one controlled pair of sites and never inspects cookies other sites have set. Real cross-site cookies also behave differently depending on their own attributes (SameSite, Secure, Partitioned with CHIPS) and on whether they were set during a top-level navigation or a user gesture.

Common questions

If the test says blocked, am I more private?

Partly. Third-party cookies are one of the most common cross-site tracking channels, so blocking them does reduce that kind of tracking, and a blocked verdict is a real privacy signal. It is not a guarantee: sites can still follow you with first-party cookies, fingerprinting, IP-based methods, and login state, and the verdict says nothing about the site you are visiting, only about your browser's default policy.

Will I get the same result in every browser?

No. Safari and Firefox block third-party cookies by default; Chrome historically allows them and, after shelving its planned phase-out in 2024, keeps them on while rolling out a consent prompt in some regions. Edge, Brave, and hardened or enterprise profiles differ again. Re-run the test in each browser you care about; one verdict does not transfer.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.