I have a requirement to store a large amount of data in cookies, to figure out if it will work
here are my tests.
If all you care about is the conclusion, well here it is: If you want to support most browsers, then don't exceed 50 cookies per domain, and don't exceed 4095 bytes per domain (i.e. total size of all cookies <= 4095 bytes)
Current Browser Test Results
About The Tests
Max Cookie Count Per Domain is calculated by adding cookies until the number of cookies saved stops increasing.
Max Cookie Size Per Cookie is calculated by increasing the cookies value one character at a time, until the saved value is truncated.
Max Cookie Size Per Domain is guessed by adding cookies of maximum size, until no more cookies can be added.
Hence, the actual limit may be more than the guessed limit. Guessed Limit <= Actual Limit < Guessed Limit + Max CookieSize
Manually Execute Tests
1. Max Cookies Test
Each cookie will be filled with the following character, repeated the specified number of times.
Character: Repeat Character Times:
Some Interesting Things
Typically, the following are allowed:
300 cookies in total
4096 bytes per cookie
20 cookies per domain
81920 bytes per domain*
* Given 20 cookies of max size 4096 = 81920 bytes.
IE (and Opera) introduces a new limit, max bytes per domain
Cookies are stored as a single string containing name, value, expiry etc.
Size limits apply to the entire cookie, not just its value.
If you use characters only in the ASCII range, each character takes 1 byte, so you can typically store 4096 characters
In UTF-8 some characters are more than 1 byte, hence you can not store as many characters in the same amount of bytes.
The ';' character is reserved as a separator. Do not use it in the key or value.
jQuery Cookie plugin stores the cookie using encodeURIComponent. Hence ÿ is stored as %C3%BF, 6 characters. This works well, as other you would lose the ';' character
You cannot delete cookies with a key that hits the size limit and has a small value. The method to delete a cookie is to set its expiry value, but when the key is large there is not enough room left to do this. Hence I have not tested limitations around key size.
It appears that some browsers limit by bytes, while others limit the number of characters.
Alternatives
jStorage is quite a good alternative that I am considering using. It stores the data on the client only (ie not sent to server) and is supported by the major browsers.
Just store an id in the cookie, and then store the data in a database
Browser Limits
After testing a few browsers myself, and using Browser Shots I have compiled the following list:
Browser
Max Cookies
Max Size Per Cookie
Max Size Per Domain1
Usage2
Chrome 4
Chrome 5
70
4096 bytes
NA
Chrome 6
70
4096 bytes
NA
Chrome 7
70
4096 bytes
NA
Chrome 8
180
4096 bytes
NA
0.6%
Chrome 9
7.7%
Chrome 10
180
4096 bytes
NA
14.8%
Chrome 11
0.8%
Chrome 12
0.1%
FireFox 2
50
4097 characters
NA
FireFox 3
50
4097 characters
NA
36.7%
FireFox 4
50
4098 characters
NA
5.2%
IE 6
50
4096 characters
4096 characters
3.0%
IE 7
50
4095 characters
4095 characters
5.4%
IE 8
50
5117 characters
10234 characters
16.3%
IE 9
1.1%
Opera 8
30
4096 bytes
4096 bytes
Opera 9
30
4096 bytes
4096 bytes
Opera 10
0.2%
Opera 11
60
4096 bytes
4096 bytes
1.9%
Safari 3
0.1%
Safari 4
0.3%
Safari 5
600
4096 bytes
4096 bytes
3.6%
Safari on mac3
?
?
?
1 NA means there is no limit other than Max Cookies * Max Size Per Cookie 2 From March 2011 W3 Schools Browser Statistics 3 Lu pointed out Safari on mac is different to windows. It appears to have no limit. I will investigate when I get more time.
Conclusion
If you want to support most browsers, then don't exceed 50 cookies per domain, and don't exceed 4095 bytes per domain (i.e. total size of all cookies <= 4095 bytes)
Updates
10 March 2011
Added Chrome 10
Safari Mac uncertain on limit
March 2011 W3 stats
Increased conclusion from 30 cookied to 50 now that opera 8 and 9 are older