browsercookielimits.iain.guru Open in urlscan Pro
52.219.164.207  Public Scan

Form analysis
0 forms found in the DOM

Text Content

BROWSER COOKIE LIMITS

I have a requirement to store a large amount of data in cookies, to figure out
if it will work here are my tests.

If all you care about is the conclusion, well here it is: If you want to support
most browsers, then don't exceed 50 cookies per domain, and don't exceed 4093
bytes per domain (i.e. total size of all cookies <= 4093 bytes)


YOUR BROWSER TEST RESULTS


Run Tests For Current Browser


ABOUT THE TESTS

Max Cookie Count Per Domain is calculated by adding cookies until the number of
cookies saved stops increasing.

Max Cookie Size Per Cookie is calculated by increasing the cookies value one
character at a time, until the saved value is truncated.

Max Cookie Size Per Domain is guessed by adding cookies of maximum size, until
no more cookies can be added. Hence, the actual limit may be more than the
guessed limit. Guessed Limit <= Actual Limit < Guessed Limit + Max CookieSize


MANUALLY EXECUTE TESTS


1. MAX COOKIES TEST

Each cookie will be filled with the following character, repeated the specified
number of times.
Character: Repeat Character Times: Execute


SOME INTERESTING THINGS

Typically, the following are allowed:
 * 300 cookies in total
 * 4096 bytes per cookie
 * 20 cookies per domain
 * 81920 bytes per domain*

* Given 20 cookies of max size 4096 = 81920 bytes.

IE (and Opera) introduces a new limit, max bytes per domain

A few notes about cookies:
 * RFC 2965
 * Someone’s experience with IE6 limits
 * Someone elses test script
 * To get a good understanding of cookies read this
 * Cookies are stored as a single string containing name, value, expiry etc.
 * Size limits apply to the entire cookie, not just its value.
 * If you use characters only in the ASCII range, each character takes 1 byte,
   so you can typically store 4096 characters
 * In UTF-8 some characters are more than 1 byte, hence you can not store as
   many characters in the same amount of bytes.
 * The ';' character is reserved as a separator. Do not use it in the key or
   value.
 * jQuery Cookie plugin stores the cookie using encodeURIComponent. Hence ÿ is
   stored as %C3%BF, 6 characters. This works well, as other you would lose the
   ';' character
 * You cannot delete cookies with a key that hits the size limit and has a small
   value. The method to delete a cookie is to set its expiry value, but when the
   key is large there is not enough room left to do this. Hence I have not
   tested limitations around key size.
 * It appears that some browsers limit by bytes, while others limit the number
   of characters.


ALTERNATIVES

 * jStorage is quite a good alternative that I am considering using. It stores
   the data on the client only (ie not sent to server) and is supported by the
   major browsers.
 * Just store an id in the cookie, and then store the data in a database


LIMITS PER BROWSER

After testing a few browsers myself, and using Browser Shots I have compiled the
following list:

Browser Max Cookies Max Size Per Cookie Max Size Per Domain1 Usage2 Chrome 4
Chrome 5-7704096 bytesNA Chrome 8-58*1804096 bytesNA60.1% * Checked on
8/10/12/13/14/15/17/25/39/58 Chrome MobileAppears same as Chrome. Verified on
Chrome Mobile 39. FireFox 2/3.6.6504097 charactersNA FireFox 3.6.13-19*1504097
charactersNA1.7% (assuming, versions before 25) * verified on
3.6.13/4/8/9/10/14/19. unverified 5-8/11-13/15-18, just assumed FireFox
21-52*1504097 bytesNA21.7% * verified on 21/24/25/30/34/52 IE 6 unpatched204096
characters4096 characters IE 6504096 characters4096 characters IE 7
unpatched204095 characters4095 characters IE 7504095 characters4095
characters0.3% IE 8/9/10/11/15505117 characters10234 characters9.5% Opera
8/9/10304096 bytes4096 bytes Opera 11604096 bytes4096 bytes Opera 12605117
bytes12093 bytes Opera 250.6% Opera 26/461804096 bytesN/A0.2% Safari 3 Safari
40.1% Safari 56004096 bytes4096 bytes Safari 60.3% Safari 7N/A4097 bytes8180
bytes1.4% Safari 81.8% Safari ? on mac360044093 bytes4most likely 4093 bytes4
Android 2.1/2.3.4504096 bytesNA Safari Mobile 5.160054093 bytes54093 bytes
Safari Mobile 7Appears same as Safari. Verified on Safari Mobile 7.

1 NA means there is no limit other than Max Cookies * Max Size Per Cookie
2 From January 2015 W3 Schools Browser Statistics
3 Lu pointed out Safari on mac is different to windows. It appears to have no
limit. I will investigate when I get more time.
4 Deeman has shared these Safari Mac results in the comments below.
5 Safari on my iPad 3 iOS 5.1 has a limit of 4096 bytes, but an overhead of 3
bytes per cookie. Hence the max for 1 cookie is 4093, and I can fit 512 cookie
of 5 bytes as 512*(5+3)=4096.



CONCLUSION

If you want to support most browsers, then don't exceed 50 cookies per domain,
and don't exceed 4093** bytes per domain (i.e. total size of all cookies <= 4093
bytes).

** I previously said 4095 bytes to account for IE7, but now iPad 3 appears to
come in a little lower.

By Iain Roberts. Created 02 March 2011. Last Updated 05 March 2013.


UPDATES

 * 26 June 2017
   * Added Chrome 58, Firefox 52, IE Edge 15
 * 02 Jan 2015
   * Added Safari 7, which compared to 5 has removed the count limit, and
     doubled the Max Size Per Domain
   * Android 4.0+ is using Chrome Mobile, which so far has the same limits as
     desktop chrome.
   * Firefox switched their limit from characters to bytes at some point
   * IE 11 same as previous versions.
   * Opera 26 (may be earlier) has copied Chrome's limits
   * Leaving conclusion as is. There are still 1.7% on 5.X iOS which has the
     4093 domain limit
 * 05 March 2013
   * Wow I last updated this over a year ago. And what an interesting year it
     has been. I have changed jobs, tried a startup (unsuccessfully so far),
     traveled, and now updated this webpage.
   * I've now hosting it on amazon, I apprechiate that atspace.com was free but
     it went down too much. I assume this is why this page doesn't rank in
     google, or maybe its just because its ugly :p
   * Added Chrome 25; IE 10 (thanks JimboG); Firefox 14 Mac (thanks Rob); IE 6
     Unpatched; Chrome several all same; Firefox several all same; Opera 12
   * Opera 12 seem to be following IE's direction, and using 5117 bytes per
     cookie, although IE is 5117 characters
   * Reduced conclusion from 4095 bytes to 4093 bytes thanks to my iPad.
 * 28 September 2011
   * Added Chrome 15; IE 9
 * 10 August 2011
   * Added Chrome 12/13; Opera 10;
   * Added Safari Mac thanks to Deeman
   * June 2011 W3 stats
 * 02 Marh 2011
   * Added Chrome 10
   * Safari Mac uncertain on limit
   * March 2011 W3 stats
   * Increased conclusion from 30 cookied to 50 now that opera 8 and 9 are older


CONTACT ME

Find anything wrong? Is there a better way? Comment below or send me an email to


Please enable JavaScript to view the comments powered by Disqus. blog comments
powered by Disqus