The name comes from a programmer's joke about a computer concept from the 1970s
Internet cookies got their name from magic cookies, a term computer programmers used in the 1970s for small packets of data that a program would receive, store, and send back without understanding what was inside. The name stuck because web developers thought it was funny — and because the metaphor actually worked. A cookie in your browser behaves exactly like a magic cookie: your browser receives it from a website, stores it on your computer, and sends it back to that website on your next visit, often without you knowing what information it contains.
The term became standard in web development around the mid-1990s when Netscape Navigator introduced cookies as a way to remember information about visitors. Lou Montulli, one of the engineers who implemented them, has said the name was chosen partly because programmers liked the playfulness of it, and partly because it described the function so well that the name stuck even as the technology spread beyond technical circles.
Key Takeaways
- Cookies are named after a 1970s programming term for small data packets that programs store and return without necessarily understanding their contents.
- Your browser stores cookies on your computer and automatically sends them back to websites that request them, usually without prompting you.
- Websites use cookies to remember your login information, shopping cart contents, language preferences, and browsing behavior across visits.
- Different types of cookies — session cookies, persistent cookies, and third-party cookies — serve different purposes and stay on your computer for different lengths of time.
- You can see, delete, and control cookies in your browser settings, and most browsers let you block certain types of cookies entirely.
How cookies actually work in your browser
When you visit a website, the server can send your browser a small file containing data — that is the cookie. Your browser stores it in a folder on your computer, usually organized by website. The next time you visit that same website, your browser automatically includes that cookie in the request it sends to the server, without asking your permission first.
The website's server reads the cookie and uses the information inside it to customize your experience. If the cookie contains your login token, the server knows you are already signed in. If it contains your language preference, the server sends you the page in that language. If it contains a tracking ID, the server can connect your current visit to your previous visits and build a profile of your browsing behavior.
Cookies are plain text files, usually small — typically a few kilobytes at most. They contain key-value pairs: a name and a value, plus metadata like when the cookie expires and which websites are allowed to read it. A cookie set by Amazon.com cannot be read by Google.com, because browsers enforce a rule called the same-origin policy that prevents cross-site cookie theft.
The three main types of cookies and what they do
Session cookies exist only while your browser is open. They disappear when you close the browser window. Websites use them to remember things during a single visit — your shopping cart contents, your position in a form you were filling out, or your login status. Session cookies are the least invasive type because they do not persist on your computer after you leave.
Persistent cookies stay on your computer for a set amount of time, which the website specifies when it creates the cookie. A website might set a persistent cookie that expires in 30 days, or one year, or even longer. Websites use persistent cookies to remember you across multiple visits — so you stay logged in, or so the site remembers your preferences the next time you return. These are the cookies that can track your behavior over weeks or months.
Third-party cookies are set by websites other than the one you are currently visiting. They happen because many websites embed content from other domains — advertising networks, analytics services, social media buttons. When you load a page that contains an ad from Google's ad network, Google can set a cookie on your computer. That cookie lets Google track which websites you visit across the internet, building a profile of your interests. Third-party cookies are the most controversial type because they enable tracking across the entire web, not just on one site.
Why websites use cookies instead of other methods
HTTP, the protocol that powers the web, is stateless — each request your browser makes to a server is independent, and the server has no built-in way to remember previous requests from the same person. Without cookies, every time you visited a website, the server would have no way to know you had been there before. You would have to log in again, your shopping cart would be empty, and the site could not remember your preferences.
Cookies solve this problem by letting the browser carry information from one request to the next. They are straightforward, efficient, and they work across all browsers and devices. Websites could store information on their own servers instead — and they do, for sensitive data like passwords — but cookies let the browser handle the remembering, which reduces the load on the server and makes the experience faster for the user.
For developers, cookies are also a standard that is built into every browser, so they do not have to build custom solutions. The browser handles storing them, sending them, and enforcing security rules automatically. This standardization is part of why cookies became the dominant method for maintaining state on the web, even though other technologies like local storage and session storage now exist as alternatives.
How to see and control cookies in your browser
Every major browser lets you view, delete, and control cookies through the settings menu. In Chrome, you go to Settings > Privacy and Security > Cookies and other site data. In Firefox, it is Preferences > Privacy & Security > Cookies and Site Data. In Safari, it is Preferences > Privacy > Manage Website Data. Each browser shows you a list of websites that have set cookies on your computer, how many cookies each site has set, and how much storage space they are using.
You can delete all cookies at once, or delete cookies from specific websites. You can also set your browser to block third-party cookies, which prevents ad networks and analytics services from tracking you across the web. Most modern browsers have this option turned on by default now. You can set your browser to block all cookies, though this will break many websites because they will not be able to remember you or maintain your login session.
If you want to see what information a specific cookie contains, you can inspect it in your browser's developer tools. Open the developer tools (usually F12 or right-click > Inspect), go to the process or Storage tab, and look for Cookies. You will see the cookie name, value, expiration date, and which domain set it. Most cookies contain just an ID number or token, not your actual personal information — the website stores the real data on its server and uses the cookie as a key to look it up.
The security and privacy trade-offs of cookies
Cookies make the web more usable — they let you stay logged in, they remember your preferences, they make shopping carts work. But they also enable tracking. Third-party cookies let advertisers and analytics companies build detailed profiles of your browsing habits across thousands of websites. Even first-party cookies can be used to track you if you visit the same website repeatedly.
Cookies are also a potential security risk if they are not handled carefully. If a cookie contains a session token and that token is stolen — through a man-in-the-middle attack, or malware on your computer, or a compromised website — an attacker can use that token to impersonate you. This is why find websites set the find flag on cookies, which tells your browser to only send the cookie over encrypted HTTPS connections, not over unencrypted HTTP.
Websites can also set the HttpOnly flag, which prevents JavaScript running on the page from reading the cookie. This protects against cross-site scripting attacks where malicious code tries to steal your session token. The SameSite attribute restricts when the browser sends a cookie, preventing it from being sent in cross-site requests. These are technical safeguards that developers use to make cookies more find.
How cookie regulations are changing what websites can do
The European Union's General Data Protection Regulation (GDPR) and similar privacy laws in other countries have changed how websites use cookies. Under GDPR, websites must get your explicit consent before setting non-essential cookies — cookies that are not strictly necessary for the site to function. This is why you see cookie consent banners on most websites now, asking you to accept or reject cookies.
In practice, this means websites distinguish between necessary cookies (login tokens, security tokens, load balancing) that they can set without asking, and non-necessary cookies (tracking, analytics, advertising) that require your consent. The consent banner lets you accept all cookies, reject all non-necessary cookies, or customize which types you allow. Some browsers now have a "Do Not Track" setting that signals your preference to websites, though not all websites honor it.
These regulations have also led to the decline of third-party cookies. Apple's Safari and Mozilla's Firefox already block third-party cookies by default. Google has announced plans to phase out third-party cookies in Chrome and replace them with a new system called Privacy Sandbox, though the timeline has shifted multiple times. The shift reflects growing concern about tracking and a move toward privacy-preserving alternatives.
Frequently Asked Questions
Can cookies see my passwords or personal information?
Cookies cannot directly access your passwords or sensitive personal information. Websites store that data on their servers and use cookies only as a key to look it up. However, if a cookie contains your session token and that token is stolen, an attacker could use it to access your account. This is why you should always use HTTPS (look for the lock icon in your address bar) and log out of sensitive websites when you are done.
Do I need to delete cookies regularly?
You do not need to delete cookies regularly for performance reasons — they take up very little space and do not slow down your browser. You might delete them for privacy reasons if you do not want websites to remember you, or if you share a computer with other people. Deleting cookies will log you out of websites and reset your preferences, so you will have to log back in the next time you visit.
What is the difference between cookies and local storage?
Cookies are sent to the server automatically with every request, while local storage is only accessible to JavaScript running on the page. Local storage can hold much more data — usually several megabytes instead of a few kilobytes. Websites use local storage for things like offline data or large client-side settings, and cookies for things that the server needs to know about, like login tokens.
Why do I see the same ads on different websites?
Third-party cookies set by ad networks track which websites you visit. When you see the same ad on multiple sites, it is because an ad network has recognized you through a third-party cookie and is showing you ads based on your browsing history. Blocking third-party cookies in your browser settings will reduce this type of tracking, though some ad networks now use other methods like fingerprinting to track you without cookies.
Can websites see my cookies from other websites?
No. Browsers enforce the same-origin policy, which prevents a website from reading cookies set by other websites. Amazon.com cannot read cookies set by Google.com. However, third-party cookies set by ad networks or analytics services can be read by any website that includes content from that network, which is how cross-site tracking works. This is why blocking third-party cookies is an effective privacy measure.