Overview
SuperCookies is a Windows desktop validator for exported cookie and session files. Point it at a folder, hit scan, and it reports which sessions are still alive — split by service, with a live log explaining why each one failed.
The pitch is speed and clarity: a recursive folder scan, per-module result grouping, and a running status feed instead of a wall of raw output.
42 modules
Every service has its own toggle, and the panel header shows how many are enabled — 42/42 in a default install. Modules are grouped by what they are:
- AI — ChatGPT, Claude, Perplexity, Grok, Gemini, Cursor, Manus.
- Streaming — Netflix, Prime Video, Apple TV, HBO Max, SkyShowtime, Hulu, YouTube.
- Music and audio — Spotify, Udio.
- Design and work — Canva, Scribd, Magnific, Make.
- Commerce and other — Humble Bundle, G2A.
- Security services — Surfshark, 2Captcha.
The module list scrolls — the visible set is a subset of the 42, and each row can be switched off if you only care about a handful of services.
Source input
- Folder — browse or drag a directory in, and the app walks it recursively.
- Paste — feed cookie data directly without touching disk.
- File counter — shows exactly how many files were picked up, e.g.
5,867 .txt files - recursive, so you know the scope before spending time on a run. - Scan and check — the single action that starts the whole pipeline.
Results dashboard
The header summarises a run in one line: total checked, how many produced at least one hit, and elapsed state. A completed run of 5,867 files reports 123 with at least one hit.
Below it, the per-module results panel totals the outcome by category:
- Hits — confirmed working sessions.
- Custom — matches that carry extra attributes rather than a plain valid login.
- Invalid — dead or revoked sessions.
Valid hits, grouped
Every module that produced a result gets its own collapsible row with a count, so you can see at a glance that ChatGPT returned nothing while something else returned several. Show only hits hides the empty modules, and Save valid exports the working set to disk.
Live activity log
The right-hand column streams each attempt as it is processed, newest first, with a colour-coded VALID or INVALID badge and the server's own reason:
- Logged out — session token no longer accepted.
- Redirect loop — the service bounced the request, a classic expired-cookie signature.
- Login failed — credentials or session rejected outright.
- No active Google session — Google-backed services with the session already cleared.
- manage-subscription - Active — a confirmed live subscription, which is the result worth keeping.
Because the reason is shown next to each line, a failed run tells you why it failed instead of just dropping the entry.
Interface
- Dark three-column layout: modules and source on the left, valid hits in the middle, live log on the right.
- Settings gear in the header for threads and behaviour options.
- Header shows the installed version and the patch credit.
Requirements
- Windows desktop application
- Exported cookie files in
.txtformat (single-file or a whole folder tree) - Working internet connection; results depend entirely on the services being reachable
