A cookie is a small text file that a website asks a browser to store. It usually holds a short string of characters, and not much else. When the browser visits that same site again, it sends the file back. That round trip is the whole idea. The site can now recognize the browser it is talking to.
Here is why that matters. The web runs on a protocol that forgets. Each request a browser makes to a server is treated as a fresh introduction, with no memory of the request before it. Without some way to carry information between page loads, a site would have no idea that the person adding a second item to a cart is the same person who added the first. A cookie is the note the site pins to the browser so the next request arrives with context attached. The technical background is covered well in the entry on the HTTP cookie, which traces the mechanism back to the mid 1990s.
Most cookies fall into a few plain categories. A session cookie keeps someone logged in while they move around a site, and it disappears when the browser closes. A persistent cookie stays on the device for a set period, which is how a site remembers a language choice or a “keep me signed in” preference weeks later. A first party cookie is set by the site in the address bar. A third party cookie is set by a different domain whose code runs on the page, often an ad network or a widget.
The contents are usually boring on purpose. A well built cookie stores an identifier, and the real information sits in a database on the server. So the cookie might say “user 4471” while the account details, cart, and history live safely on the site’s own systems. This keeps sensitive data off the device and makes the cookie easy to expire or replace.
A few common jobs cookies do:
- Keep a shopping cart intact between pages
- Remember that someone is logged in
- Store a display preference like dark mode or a chosen currency
- Count whether a visitor is new or returning
- Carry a token that helps block certain kinds of form abuse
The category that draws the most attention is tracking. A third party cookie set across many sites can link the same browser from one place to the next, building a picture of where it goes. That is the behavior privacy laws in Europe and elsewhere aimed at when they required consent banners. It is also why browsers have been steadily restricting third party cookies. The mechanism itself is neutral. A cookie that keeps a cart working and a cookie that follows someone across the internet use the same underlying feature, put to very different uses.
For someone running a small website, the practical takeaways are short. Cookies a site sets for its own basic operation, like login and cart, are the ones that are hard to avoid and rarely controversial. Cookies added by outside scripts, like ad pixels and some analytics, are where obligations and questions pile up. Knowing which cookies a site actually sets is the first step, and browser developer tools list every one of them under a storage or application tab.
A cookie has limits worth remembering. It only works for the domain that set it, so one site cannot read another site’s cookies directly. It has a size cap of about 4 kilobytes, so it holds a little, not a lot. And a visitor can delete cookies or block them, which means a site should treat them as helpful rather than guaranteed.
That is the whole story. A cookie is a small labeled note a site leaves with a browser so the next visit is not a stranger. Everything else is a question of what goes on the note and who gets to read it.