I'm researching how web cookies are physically stored by browsers. Modern Chrome appears to keep them in an SQLite database, possibly with encryption. Do other browsers use similar database-based storage, or can they choose completely different formats? In older browsers, were cookies stored as individual files, or were all cookies kept together in one file?
2 Answers
The exact on-disk design depends on the browser and operating system. Modern browsers usually organize data by origin—roughly, a website’s scheme, domain, and port—so data belonging to one site is kept logically separate from another site’s data. Cookies may be stored in a shared database with records identifying their domain, while caches and other site data may use separate files or databases. Browsers also enforce storage limits and can remove older data when space is needed.
There’s no universal storage format that every browser has to follow. Older browsers such as Netscape Navigator commonly kept all cookies in one text file, often called cookies.txt, with one line for each cookie rather than a separate file per cookie. Tools such as cURL still support that general format. Modern browsers tend to use databases, encrypted files, or other internal formats, which makes direct cookie theft more difficult but doesn’t make it impossible.
By “origin,” this means the security identity of a website. For example, https://example.com and https://another-site.com are different origins, so a browser keeps their site data separate. Even different ports or protocols can make two addresses different origins.