What is the maximum size of a cookie, and how many can be stored in a browser for each web site?

by

No more than 50 cookies per domain, with a maximum of 4 KB per cookie (or even 4 KB in total, see Iain’s answer). On IE 6 it used to be 20 cookies per domain.

Generally it’s recommended to preserve state on the server, and use cookies only for session tracking. They’re sent along with every request, so they form an unnecessary overhead if the purpose is to keep session state around.

If you do want to keep state on the client, and you can use JavaScript to do it, there are options. Use the assorted storage API’s directly or find a wrapper library that abstracts away the details.

Client-side storage options:

  • localStorage: Firefox 2+, Chrome 4+, Safari 4+, Internet Explorer 8+. 5 MB per domain without user confirmation (but be aware that it is stored as UTF-16 so you may use two bytes per character).
  • IndexedDB: Firefox 4+, Chrome 11+, Safari 10+, Internet Explorer 10+. 5 MB per domain without user confirmation, much more after confirmation (highly browser specific, check your browser for details).

Deprecated storage options:

  • Flash 8 persistent storage: any browser with Flash 8+. 100 KB, more with user permission. Deprecated because Flash itself is deprecated.
  • userData: Internet Explorer 5.5+. 64 KB per domain in the restricted zone, 128 KB per domain in the internet zone. Replaced by localStorage.
  • Web SQL: Chrome & Safari only, it will never make it to other browsers because it was not possible to standardize it.

So, generally for client-side storage it depends on the use case:

  • For session id tracking or for a few KB, use cookies.
  • Up to 2 MB, localstorage delivers a solution across all common browsers.
  • 2 MB and up, use IndexedDB (look for a good wrapper library).

More Related Contents:

  1. Cross-Domain Cookies
  2. Cookies on localhost with explicit domain
  3. What are allowed characters in cookies?
  4. Fetch API with Cookie
  5. Clear cookies on browser close
  6. Safari doesn’t set Cookie but IE / FF does
  7. What does the dot prefix in the cookie domain mean?
  8. Setting a cookie using JavaFX’s WebEngine/WebView
  9. How does Facebook set cross-domain cookies for iFrames on canvas pages?
  10. Why won’t asp.net create cookies in localhost?
  11. How cookies work?
  12. Can two different browser share one cookie?
  13. Send cookies with curl
  14. IE8 losing session cookies in popup windows
  15. how to disable cookies using webdriver for Chrome and FireFox JAVA
  16. Cookie path and its accessibility to subfolder pages
  17. Same-Site flag for session cookie in Spring Security
  18. How do I access HttpContext in Server-side Blazor?
  19. Does every web request send the browser cookies?
  20. Sending cookies with postman
  21. How to add a cookie to the cookiejar in python requests library
  22. Yahoo Finance Historical data downloader url is not working
  23. When does a cookie with expiration time ‘At end of session’ expire?
  24. How to handle expired access token in asp.net core using refresh token with OpenId Connect
  25. Adding files cookies PHP (host)
  26. can i be notified of cookie changes in client side javascript
  27. jQuery $.cookie is not a function
  28. asp.net cookies, authentication and session timeouts
  29. localStorage vs sessionStorage vs cookies
  30. Can I change the FormsAuthentication cookie name?

Leave a Comment