01Location
- <Firefox profile>/cookies.sqlite
02Questions it answers
- Which hosts stored cookies in this profile?
- When was a cookie created, last accessed and last updated?
- Was a cookie stored under particular origin attributes (for example a partitioned context)?
03Format and versions
| Format | SQLite 3 database, table moz_cookies, schema version 17 in current source. Mixed units: expiry in milliseconds, other times in microseconds since 1970-01-01 UTC. |
|---|---|
| Applies to | Schema 16 converted expiry from seconds to milliseconds; schema 17 added updateTime. Older profiles hold expiry in seconds. |
04Key fields
| Field | What it tells you |
|---|---|
| host, name, value, path | Cookie identity and value. |
| originAttributes | Serialised origin attributes; part of the unique key with name, host and path. |
| isSecure, isHttpOnly, sameSite, schemeMap, isPartitionedAttributeSet, inBrowserElement | Attribute flags as stored by Firefox. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| expiry | int64 ms since 1970-01-01 UTC (schema ≥ 16); seconds in older schemas | Check PRAGMA user_version before converting. |
| creationTime | int64 µs since 1970-01-01 UTC | Made unique per cookie; Firefox may advance it by 1 µs to avoid collisions. |
| lastAccessed | int64 µs since 1970-01-01 UTC | Last access as tracked by the cookie service. |
| updateTime | int64 µs since 1970-01-01 UTC | For cookies migrated into schema 17 this was set to the migration time, not the real update time. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy cookies.sqlite with any -wal file and read PRAGMA user_version.
- Convert expiry with the unit that matches the schema and the other times as microseconds.
- Look for clusters of identical updateTime values that indicate a schema migration rather than user activity.
- Correlate creationTime with places.sqlite visits to the same host.
07Interpretation pitfalls
- Three units coexist in one table (ms, µs and, in old files, seconds); verify each column before conversion.
- The last microsecond digits of creationTime can be adjusted for uniqueness and are not a precise event time.
- Third-party resources can set cookies for hosts the user never visited directly.
09Sources
- Firefox source — netwerk/cookie/CookiePersistentStorage.cpp Mozilla (GitHub mirror) · checked 2026-10-14
- Firefox source — netwerk/cookie/Cookie.h Mozilla (GitHub mirror) · checked 2026-10-14
- Firefox source — netwerk/cookie/Cookie.cpp Mozilla (GitHub mirror) · checked 2026-10-14
- Profiles — Where Firefox stores your bookmarks, passwords and other user data Mozilla Support · checked 2026-10-14