Number and size limits of a cookie in Internet Explorer

Microsoft Internet Explorer complies with the following RFC 2109 recommended minimum limitations:

• at least 300 cookies
• at least 4096 bytes per cookie (as measured by the size of the characters that comprise the cookie non-terminal in the syntax description of the Set-Cookie header)
• at least 20 cookies per unique host or domain name

Note These recommended minimum limitations appear in RFC 2109, section 6.3, "Implementation Limits." For more information, see the "References" section.

Each cookie begins with a name-value pair. This pair is followed by zero or by more attribute-value pairs that are separated by semicolons. For one domain name, each cookie is limited to 4,096 bytes. This total can exist as one name-value pair of 4 kilobytes (KB) or as up to 20 name-value pairs that total 4 KB. If the computer does not have sufficient space to store the cookie, the cookie is discarded. It is not truncated. Applications should use as few cookies as possible and as small a cookie as possible. Additionally, applications should be able to handle the loss of a cookie.

If a Web application uses more than 19 custom cookies, ASP session state may be lost. Internet Explorer 4.0 and later versions allow a total of 20 cookies for each domain. Because ASPSessionID is a cookie, if you use 20 or more custom cookies, the browser is forced to discard the ASPSessionID cookie and lose the session.

To store more than 20 name-value pairs for a domain, you can create a cookie dictionary by concatenating several name-value pairs for each cookie up to the 4,096-byte limit for that cookie. Currently, to retrieve these values from client-side scripting, you must parse the cookies manually. However, the Active Server Pages Request and Response objects include built-in functionality to work with cookie dictionaries as dictionary objects. The following sample code demonstrates the use of cookie dictionary in an ASP page: Note In Internet Explorer 5.0 and later, you can use the userData behavior to persist data across sessions. This behavior has a greater capacity than cookies.

If you use the document.cookie property to retrieve the cookie on the client side, the document.cookie property can retrieve only 4,096 bytes. This byte total can be one name-value pair of 4 KB, or it can be up to 20 name-value pairs that have a total size of 4 KB.

The document.getcookie function calls the CDocument::GetCookie method in Microsoft HTML.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

For more information about the RFC 2109 specifications, see the following Web sites: For more information about the Cookies collection, see the following Microsoft Developer Network (MSDN) Web site: For more information about the userData behavior, see the following MSDN Web site: For more information about cookies, see the following Cookie Central Web site: For more information, click the following article number to view the article in the Microsoft Knowledge Base: For more information about developing Web-based solutions for Microsoft Internet Explorer, visit the following Microsoft Web sites:Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.