What Is an HTTP Cookie?

An HTTP cookie is a small piece of data that a website asks your browser to store and send back on subsequent requests. Because HTTP itself is stateless — each request is independent — cookies are the original mechanism for remembering state, such as whether you are logged in, what is in your shopping cart, or your site preferences. The cookie was introduced by Lou Montulli at Netscape in 1994.

How Cookies Work

When a server wants to set a cookie, it includes a Set-Cookie header in its HTTP response, for example Set-Cookie: session_id=abc123. The browser stores that value and automatically attaches it to every later request to the same site via the Cookie header, so the server can recognize the returning visitor. Cookies can also be created and read in JavaScript through document.cookie, unless they are marked HttpOnly.

Session vs. Persistent Cookies

A session cookie has no expiry date and is deleted when you close the browser — it is meant for short-lived state like a login session. A persistent cookie carries an Expires date or a Max-Age and survives browser restarts until that time passes, which is how sites remember you for days or weeks.

First-Party vs. Third-Party Cookies

A first-party cookie belongs to the domain you are visiting. A third-party cookie is set by a different domain — typically an ad or analytics network embedded in the page — and historically enabled cross-site tracking. Browsers have steadily restricted third-party cookies, and the industry is moving toward alternatives, so they are far less reliable than they once were.

Key Cookie Attributes

• Secure sends the cookie only over HTTPS.
• HttpOnly hides it from JavaScript, which limits damage from cross-site scripting.
• SameSite (Strict, Lax, or None) controls whether the cookie is sent on cross-site requests and is a key defense against cross-site request forgery.
• Domain and Path scope which requests include the cookie.
• Expires / Max-Age set its lifetime.

Cookies vs. Other Browser Storage

Cookies are not the only way to store data in the browser. localStorage and sessionStorage hold larger amounts of data and are not sent with every request, which makes them better for purely client-side state — but they are not automatically available to the server the way a cookie is. Choose cookies when the server needs the value on each request (like a session token), and Web Storage when the data only matters in the browser.

Common Uses of Cookies

In practice, cookies power a handful of everyday features: keeping you signed in as you move between pages (session and authentication cookies), remembering preferences such as your language or a dark-mode setting, holding a shopping cart before checkout, and — subject to consent — measuring traffic and personalizing advertising. The same small mechanism underlies most of the state you take for granted on the web, which is why understanding cookies is fundamental to web development and to protecting user privacy.

Cookies are one of several browser storage options — compare them in cookies vs. localStorage, and see why HTTPS matters for protecting them in transit.

Frequently Asked Questions