01Location
- <User Data>/<Profile>/Network/Cookies
- <User Data>/<Profile>/Cookies (profiles whose network data has not been migrated)
02Questions it answers
- Which sites set persistent cookies in this profile, and when were they first created?
- When was a cookie last sent or accessed, and when was it last updated?
- Was a cookie set by an HTTP response or by script?
- Was a cookie partitioned under a particular top-level site?
03Format and versions
| Format | SQLite 3 database, table cookies; schema version 24 in current source. Times are int64 µs since 1601-01-01 UTC. |
|---|---|
| Applies to | Schema version history in the source runs from version 4 (2009) to 24 (2024-08-15). The network-service data directory (Network) is used once migration from the profile root has succeeded. |
04Key fields
| Field | What it tells you |
|---|---|
| host_key, name, path | Domain, cookie name and path; part of the unique index. |
| top_frame_site_key | If not empty, the scheme and site of the top-level frame the cookie was created in (partition key). It is not the site-for-cookies. |
| value / encrypted_value | Since schema 7 new values may be stored encrypted on selected operating systems, leaving value empty. This record does not cover decryption. |
| is_secure, is_httponly, samesite, priority | Cookie attributes as stored by the browser. |
| has_expires, is_persistent | Added in schema 5 so that session cookies can be stored as well as persistent ones. |
| source_scheme, source_port | Whether the setting URL used a cryptographic scheme, and its port (-1 when unknown for migrated rows). |
| source_type | Source of the last set or update: unknown, HTTP, script or other (schema 22+). Older rows default to unknown. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| creation_utc | int64 µs since 1601-01-01 UTC | Carried forward when a cookie is updated, so it can predate the current value. |
| last_update_utc | int64 µs since 1601-01-01 UTC | Schema 18+: if not 0, the last time the cookie was updated. |
| last_access_utc | int64 µs since 1601-01-01 UTC | Last access as tracked by the cookie store. |
| expires_utc | int64 µs since 1601-01-01 UTC | Schema 19 capped stored expiry to no more than 400 days ahead for cookies with has_expires. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Check both candidate paths and read the schema version from the meta table before interpreting columns.
- Convert the four time columns to UTC and compare creation_utc with last_update_utc to separate first creation from later rewrites.
- Group by host_key and top_frame_site_key to see first-party and partitioned use of the same domain.
- Correlate cookie times with History visits for the same host.
07Interpretation pitfalls
- Cookie values may be encrypted; the presence of a row shows that a cookie existed, not what it contained.
- Session cookies may or may not be written, depending on browser settings and shutdown; absence is weak evidence.
- A cookie can be set by a third-party resource without the user visiting that domain directly.
09Sources
- Chromium source — net/extras/sqlite/sqlite_persistent_cookie_store.cc The Chromium Authors (GitHub mirror) · checked 2026-10-14
- Chromium source — chrome/common/chrome_constants.h (kCookieFilename, kNetworkDataDirname) The Chromium Authors (GitHub mirror) · checked 2026-10-14
- Chromium source — network_context.mojom (data_directory, trigger_migration) The Chromium Authors (GitHub mirror) · checked 2026-10-14
- Chromium source — sql/statement.cc (BindTime / ColumnTime) The Chromium Authors (GitHub mirror) · checked 2026-10-14
- Chromium source — base/time/time.h (base::Time) The Chromium Authors (GitHub mirror) · checked 2026-10-14
- Chromium source — docs/user_data_dir.md (User Data Directory) The Chromium Authors (GitHub mirror) · checked 2026-10-14