Cookie jar

A cookie is a small named value a site asked the browser to keep. The attributes around it decide when it comes back and to whom.

• Domain and path

  Which site and which part of it the cookie is sent to.

• Expiry

  A date, or nothing at all, which makes it last only until the browser closes.

• Secure

  Sent over an encrypted connection and never over a plain one.

• HttpOnly

  Hidden from page scripts and readable by the server alone.

• SameSite

  Whether it goes along on a request that started at another site.

This one value is read in your browser on this page. It says whether this browser is willing to keep cookies at all.

The jar sits in the profile's own folder, so two profiles never share a sign-in. Deleting a cookie in one of them leaves the other untouched.

This is also why one account opened in two profiles is two separate sessions rather than one.

Export reads the whole jar rather than the cookies of the page in front of you. What it writes is live sign-ins, so the app warns you before writing the file and keeps it readable by your account only.

Import puts each cookie back with its domain, path, expiry and flags. Whatever was refused is counted and shown next to what arrived, because a bare number reads as a complete transfer.

A profile created five minutes ago has an empty jar, no history and nothing cached. That is a state of its own and it is visible.

The cookie robot browses ordinary public sites in the profile first. The choice of sites and their order differ from run to run, because two profiles browsing the same sites in the same order have traded one link for another.

• Local storage

  Kept per site and per profile as well, and never attached to a request on its own.

• Cache

  Files kept so they need not be downloaded twice. It carries no session.

• A fingerprint

  Computed on demand from the device. Nothing is stored, so there is nothing to clear.

• A session token

  The value inside a cookie. The jar is where it lives and the set of rules that send it.