46

What are the generic cookie limits for modern browsers, as of 2011? I'm particularly interested in:

  • Max size of a single cookie
  • Max number of cookies per host/domain name + path
  • Max number of cookies per host/domain name
  • Max number / max total size of all cookies in a given browser

I'm aware of RFC 2109 that specifies:

  • at least 300 cookies
  • at least 4096 bytes per cookie (as measured by the size of the characters that comprise the cookie non-terminal in the syntax description of the Set-Cookie header)
  • at least 20 cookies per unique host or domain name

but what are real-world specs?

GreyCat
  • 16,622
  • 18
  • 74
  • 112

4 Answers4

72

Here's a handy tool to test it: http://browsercookielimits.iain.guru/

It reveals quite a lot about the internal details regarding cookies. Click "Run Tests for Current Browser" for the results (it only takes a moment).

For example, I ran all tests for Mozilla Firefox 102.12.0esr :

1:39:10.65: Starting
1:39:10.725: Count: Gave up counting cookies with Character Length 3 and character "1": 1000
1:39:12.442: Size: Max Cookie Character Length using character "1": 4097
1:39:28.529: Count: Gave up counting cookies with Character Length 4097 and character "1": 1000
1:39:29.154: Size: Max Cookie Character Length using character "ÿ": 2049
1:39:43.612: Count: Gave up counting cookies with Character Length 2049 and character "ÿ": 1000
1:39:44.668: Count: Gave up counting cookies with Character Length 100 and character "1": 1000
1:39:45.339: Count: Gave up counting cookies with Character Length 10 and character "1": 1000
1:39:45.997: Count: Gave up counting cookies with Character Length 5 and character "1": 1000
1:39:46.239: Guessing Max Cookie Count Per Domain: NA
1:39:46.239: Guessing Max Cookie Size Per Cookie: 4097 bytes
1:39:46.240: Guessing Max Cookie Size Per Domain: NA

This answer is pretty old, but I just updated it. Hope it helps.

Please treat your mods well.
  • 4,321
  • 1
  • 25
  • 35
  • 2
    Looks like it's viable and good source of information! Thanks! – GreyCat Mar 28 '11 at 23:42
  • 3
    I've seen Chrome delete more than 25 cookies when it hits 181, so I wouldn't count on it storing more than 150. – Webveloper Jun 04 '12 at 22:02
  • Thank you for this resource! I tested Chrome 65, Firefox 59 and IE 11. Chrome results remain the same. Firefox 59 allows 1000+ cookies per domain and 4097 bytes per cookie. IE 11 allows 50 cookies per domain and 5117 bytes per cookie. – denis bider Mar 24 '18 at 21:01
9

According to this thread, Firefox 3.5 raised the total limit for all hosts to 3000, and Chrome followed their lead. All I've found for IE is "at least 300".

Also, while regular Safari appears to be unlimited, Mobile Safari (iPod Touch 2G) has a limit of 50 cookies per host, as does Android Browser (Android 2.2).

Webveloper
  • 1,059
  • 10
  • 15
4

You may also want to take a look at javascript for Client Side Storage, it's a feature of HTML5 that allows several Megabytes of data to be kept unseen on a visitors PC.

Several variants exist, here's one with good documentation http://www.jstorage.info/

Aside from Opera 10.10 and Safari-3 all mainstream browsers including IE6 support the feature. Though IE6 can only store 128kb as opposed to the 5 to 10 Mbytes that the more recent offerings can. Of course how often older versions of Opera and Safari show up in the visitor logs varies with each site so may not be ideal for all.

ysth
  • 96,171
  • 6
  • 121
  • 214
Skizz
  • 646
  • 5
  • 8
  • Sadly, I need a lowest common denominator in terms of cookies: i.e. a solution that will work everywhere where cookies work - so, HTML5 features are not an option... – GreyCat Apr 25 '11 at 20:33
  • Aside from Opera 10.10 and Safari-3 all mainstream browsers including IE6 support the feature. Though IE6 can only store 128kb – Skizz Apr 26 '11 at 01:44
  • I have a question on this subject. Anyone know how many characters are allowed in the cookie name? – Fred Chateau Jan 07 '14 at 21:19
  • You do not need a wrapper package. Go direct with: http://www.w3schools.com/html/html5_webstorage.asp – historystamp Dec 18 '16 at 00:19
2

In Firefox >= 63, the max number of cookies per domain is 180, cf pref "network.cookie.maxPerHost". When it reaches the limit, it will drop stale cookies, then drop non secure cookies. If nothing works, it will simply refuse the cookie (cf netwerk/cookie/nsCookieService.cpp)

Pascal Pixel Rigaux
  • 632
  • 8
  • 8