What a cookie is
Why it matters Cookies are behind every "remember me" box and every cookie banner you have ever seen. They keep you logged in, and they are also the oldest way trackers follow you. Understanding them turns the banners from noise into a choice you can make.
A cookie is like a cloakroom ticket. When you hand over your coat, the attendant gives you a ticket with a number. Each time you come back, you show the ticket, and they know which coat is yours. The ticket does not contain your coat; it just lets them recognise you.
Cookie: a small piece of text that a website asks your browser to store, and that your browser sends back to that website on later requests. A typical cookie is a name and a value, such as session=8f3k2q.
Why cookies exist at all
The web was designed to forget. Each request is handled on its own, so without help a shop would not know that the person adding boots to a basket is the same person who added a hat a minute ago.
Cookies fixed that in the mid-1990s. They give the browser a way to carry a ticket, so the site can say "ah, it is you again". Logins, shopping baskets, language choices and dark mode settings all rely on them.
How a cookie is set and sent back
It happens in two steps, using two headers.
- You visit
shopa.example. Its server replies with your page and a header:Set-Cookie: basket=b-41. Your browser stores it. - Every later request your browser sends to
shopa.examplecarries a header:Cookie: basket=b-41. The server looks up basket b-41 and shows your boots.
Set-Cookie: the header a server sends to ask your browser to store a cookie.
Cookie header: the header your browser sends back, carrying the cookies that belong to that site.
A page's own scripts can also create cookies, without the server asking. Either way, the key rule is the same: a cookie goes back only to the site it belongs to. Your browser does not send shopa.example's cookie to some other shop.
How long cookies last
A cookie with no end date is a session cookie: it is meant to disappear when you close the browser (although some browsers restore sessions, so it may live longer). A cookie with an end date is a persistent cookie and survives restarts until that date. The attributes lesson shows how sites set that date.
A common misconception
"Cookies are programs that spy on my computer." A cookie cannot run, read your files or see other sites by itself. It is just a ticket. What makes some cookies a privacy problem is who issues the ticket and on how many sites they get to see it, which is the next lesson.
Recap
- A cookie is a small name and value that a site stores in your browser.
- The server sets it with Set-Cookie; your browser sends it back with the Cookie header.
- A cookie goes back only to the site it belongs to.
- Cookies are not programs; the privacy question is who sets them and where they are seen.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.