Cookies are small files your browser stores on your computer that remember information about you between visits

When you visit a website, the site's server can ask your browser to save a small text file called a cookie. That file sits on your hard drive. The next time you visit the same website, your browser automatically sends that cookie back to the server, and the server reads what's inside. The website now knows something about you — your login name, what you put in your shopping cart, what language you prefer, or that you've already seen a particular advertisement.

Cookies exist because HTTP, the language websites use to talk to your browser, has no memory. Each time you load a new page, the server has no way to know you're the same person who was just on the previous page. Cookies bridge that gap. Without them, you'd have to log in again every time you clicked a link, and online shopping would be impossible.

A cookie is just text — a few lines of code that might say something like "user_id=4729" or "language=Spanish". It cannot run programs, steal passwords, or install software. It can only store and send back information the website put there in the first place.

Key Takeaways

  • Cookies are text files stored on your computer that websites use to remember information about you between visits.
  • First-party cookies come from the website you're visiting; third-party cookies come from advertisers or other companies whose content appears on that site.
  • You can see what cookies a site has stored, delete them, or block new ones from being created in your browser settings.
  • Cookies cannot run code or steal passwords, but they do let advertisers track which websites you visit across the internet.

How a cookie gets created and sent back

When you land on a website, the server sends your browser a response that includes instructions to create a cookie. Your browser reads those instructions and saves the file to your hard drive in a folder reserved for cookies. The cookie includes an expiration date — it might last until you close your browser, or it might last for years.

The next time your browser connects to that same website, it checks the cookie folder, finds any cookies that belong to that site, and automatically includes them in the request it sends to the server. The server reads the cookie and knows who you are, what you've done before, or what settings you prefer. It sends back a page tailored to that information.

This happens invisibly. You don't see the cookie being created or sent. Your browser handles it in the background.

First-party cookies versus third-party cookies

A first-party cookie comes from the website you're actually visiting. If you log into your email account, the email server creates a cookie that remembers your login. If you add items to a shopping cart, the store creates a cookie that remembers what's in it. These cookies only get sent back to that one website.

A third-party cookie comes from a different company whose content appears on the page you're viewing. An advertising network might place an ad on a news site, and that ad includes a request to create a cookie. That cookie gets sent back to the advertising network, not to the news site. The advertising network uses it to track which websites you visit across the internet, so it can show you ads based on your browsing habits.

Third-party cookies are why you see ads for shoes on a news site after you looked at shoes on a shopping site. The advertising network saw both visits and connected them to the same person.

What information cookies actually store

A cookie is limited to about 4 kilobytes of text — roughly 4,000 characters. It cannot store your password, your credit card number, or your Social Security number, because websites don't put that information in cookies. Sensitive data stays on the server.

What cookies typically store: your username or user ID, your language preference, whether you've agreed to the site's cookie policy, items in your shopping cart, your login session (a temporary token that proves you're logged in), or an identifier that an advertising network uses to track you. Some cookies store the date and time you last visited, or which pages you looked at.

The information is only as private as the website that created it. A reputable site encrypts the cookie so that even if someone steals your computer, they can't read what's inside. A poorly built site might store information in plain text. Either way, the cookie itself cannot do anything — it can only be read by the server that created it (or, in the case of third-party cookies, by the company that placed the ad).

Why websites use cookies instead of other methods

Cookies are the oldest and simplest way for a website to remember you. The alternative is to store everything on the server — your preferences, your cart, your login status — and look it up every time you visit. That works, but it requires the server to store data for millions of users and look up the right data for each request. Cookies move that burden to your computer.

Cookies are also portable. If you use the same browser on your phone and your laptop, and you visit the same website on both, the website can recognize you on both devices (though the cookies themselves are stored separately on each device). Some websites use other methods — like local storage or session storage — which work similarly but are stored differently on your computer. Cookies remain the standard because they've been around since 1994 and every browser supports them.

How to see, delete, and block cookies

Every browser lets you see what cookies are stored on your computer. In Chrome, go to Settings, then Privacy and Security, then Cookies and Other Site Data. You'll see a list of websites that have stored cookies, and you can click on each one to see what's inside. You can delete cookies from a single site, or delete all cookies at once.

You can also block cookies before they're created. In most browsers, you can set your cookie preferences to block all cookies, block only third-party cookies, or block cookies from specific sites. If you block all cookies, some websites won't work properly — you'll have to log in repeatedly, and shopping carts won't remember items. If you block only third-party cookies, the site itself will still work, but advertisers won't be able to track you across the internet.

Many browsers now block third-party cookies by default. Safari, Firefox, and Chrome (as of 2024) all limit third-party cookies without requiring you to change any settings. You can still adjust these settings if you want to be more or less restrictive.

The difference between cookies and tracking pixels

A tracking pixel is a different method that serves a similar purpose. It's a tiny, invisible image (usually 1 pixel by 1 pixel) embedded in a website or email. When your browser loads the image, it sends a request to the server that placed it, and that server logs the fact that you viewed the page or opened the email. Tracking pixels don't store information on your computer — they just send information to a server.

Advertisers use tracking pixels to count how many people saw an ad, or to confirm that you visited a website after clicking an ad. Email marketers use them to know whether you opened an email. Tracking pixels are harder to block than cookies, because your browser has to load images to display web pages properly. Some email clients block images by default, which prevents tracking pixels from working.

Frequently Asked Questions

Can a cookie steal my password or credit card number?

No. A cookie can only store information that the website put there. Websites don't put passwords or credit card numbers in cookies because that would be unsafe. If a hacker steals your computer, they cannot read encrypted cookies, and even if they could, the cookie wouldn't contain sensitive data. Passwords and credit card numbers are stored on the server, not on your computer.

Why do I see ads for things I looked at on other websites?

Third-party cookies and tracking pixels let advertising networks follow you across the internet. When you visit a shopping site, an ad network creates a cookie or tracking pixel that identifies you. When you visit a news site that shows ads from the same network, that network recognizes you and shows you ads based on what you looked at before. You can block third-party cookies in your browser settings to reduce this tracking.

If I delete my cookies, will websites still work?

Most websites will still work, but you'll lose some convenience. You'll have to log in again, your shopping cart will be empty, and the site won't remember your preferences. The next time you visit, the website will create new cookies. Deleting cookies is safe and doesn't harm your computer or the website.

What's the difference between cookies and cache?

Cache stores copies of images, videos, and other files so your browser doesn't have to read them again. Cookies store information about you. Cache makes websites load faster; cookies make websites remember you. You can delete both separately in your browser settings.

Do I need to accept cookies when a website asks?

That depends on the cookie. Websites are required by law in many countries to ask before creating cookies that track you for advertising. You can usually refuse those cookies and still use the site. Cookies that are necessary for the site to work — like login cookies — are often created without asking. Read the cookie notice to see which cookies are optional and which are required.