Secure is a cookie attribute that tells the browser to send that cookie only over HTTPS, not plain HTTP. It does not encrypt the cookie by itself; it simply prevents the browser from exposing it on unencrypted connections. In practice, this reduces the chance that a network attacker can capture or tamper with the cookie in transit.
In cyber security, Secure matters because cookies often carry session IDs, tracking tokens, or other identifiers that can be reused if stolen. Attackers look for cookies that are missing Secure on sites that still accept HTTP, because those cookies may leak on open Wi-Fi, through misconfigured redirects, or via downgrade attacks. Defenders pair Secure with HttpOnly, SameSite, and strict HTTPS-only deployment to limit session theft and cross-site abuse. In advertising and analytics, Secure is also common when a token is meant to move between related HTTPS services while staying protected on the wire.