How Cookies Work
A website leaves a small note (a cookie) in your browser. The next time the browser asks that site for a page (a request), it attaches the note. Change the conditions and see when the note is sent and when it is not.
Cookie: sid=abc123
The server's Set-Cookie
Set-Cookie: sid=abc123; Max-Age=60
Conditions of the next request
Checks before sending
- ✓ Expiry Still valid
- ✓ Host Host matches
- ✓ Path Path matches
- ✓ Connection Condition met
- ✓ SameSite Allowed in this situation
- ✓ Blocking setting Not blocked
Sent ・ Page JavaScript can read it
A simplified teaching model. Times are seconds inside the model.
How to play
Your goal is to find out when the cookie is sent in step 3 and when it is not. Press "Auto" above to play the picture in order: (1) the first request, (2) the server's response (Set-Cookie means "please keep this note"), (3) the next request. Change the Set-Cookie settings in the middle and the conditions of the next request below. Step 3 updates at once. The checklist tells you why a cookie was not sent.
Learn more
A cookie is a small "name=value" note that a server hands over in a Set-Cookie header. The browser stores it and attaches it, in a Cookie header, only to requests that meet its conditions. Only the name and value come back; attributes such as Domain and Path are not sent. The lifetime comes from Max-Age or Expires. If both are present, Max-Age wins, and with neither it is a "session cookie" that goes away when the browser is closed. Without Domain, the cookie goes to that exact host only; with Domain it also goes to subdomains, but a browser will not accept a Domain that does not include the server's own domain. Secure means "send over https only", and HttpOnly hides the cookie from the page's JavaScript. SameSite decides whether it is attached to requests coming from another site: Strict means the same site only, Lax means the same site plus following a link from elsewhere, None means anywhere (and needs Secure). With no setting, it is treated as Lax. Here, a "site" is counted simply as the last two names, like example.com. RFC 6265 is the current specification. A revision that includes SameSite (RFC 6265bis) is at a late stage at the IETF and is not yet an RFC, as of the December 2025 version. "Third-party cookies" are set by parts embedded in another site, used for ads and embeds, and they can also tell that the same browser visited several sites. Browsers differ: Safari blocked them by default in March 2020, Firefox began separating cookies per site by default in June 2022, and Chrome announced in April 2025 that it would drop its plan to phase them out and keep letting users choose in settings. This area changes quickly, so check each browser's own notes for the latest. The animation is a simplified teaching model.
Read more about it: Behind the web: cookies, DNS, video and text generation →