title: Encoding scheme used for cookies
body: <p><a href="https://www.rfc-editor.org/rfc/rfc6265#section-6.1" rel="nofollow noreferrer">RFC 6265 Sec 6.1</a> specifies allowing atleast 4096 bytes per cookie.</p>
  <p>Now in order to know the number of <strong>characters</strong> allowed per cookie, I need to know the character encoding being used for cookies, as the RFC specifies the maximum size per cookie in terms of <strong>bytes</strong> and not <strong>characters</strong>.</p>
  <p>How do I know the encoding being used to store cookies?</p>
  <p>Is it determined by the character encoding used by the programming language used to create cookies (e.g PHP, JavaScript) or the character encoding being used by the browser storing cookies?</p>
  <h2>Update:</h2>
  <p>I conducted a few tests, and it appears that FF, Chrome and Opera seem to be using UTF-8 for cookie storage, and the encoding obviously <strong>affects</strong> the number of <strong>characters</strong> you could store in a cookie. The maximum number of characters allowed in a cookie would be affected by the character encoding being used to store cookies on a client.</p>
  <p>Suspecting the browsers are using UTF-8 as the character encoding for cookies, I used the tests <a href="http://browsercookielimits.x64.me/" rel="nofollow noreferrer">here</a> with a single-byte UTF-8 character (<code>1</code>), two-byte UTF-8 character (<code>£</code>), a 3-byte UTF-8 character (<code>畀</code>), and a 4-byte UTF-8 character (<code></code>). I've pasted the results obtained below.</p>
  <p>Every cookie set used a single-byte cookie name, and the number of characters mentioned <strong>does not include</strong> the single-byte character for the cookie name and the character <code>=</code> used to separate cookie name and coookie value. The value in <code>[]</code> beside each Unicode character denotes its hex representation in UTF-8.</p>
  <p><strong>FF 31.0</strong></p>
  <p>Firefox relaxes the RFC limit by a byte and puts a limit of 4097 bytes per cookie.</p>
  <ol>
  <li>1-byte character (<code>1</code>, [0x31])                       -- 4095 characters</li>
  <li>2-byte character (<code>£</code>, [0xC2, 0xA3])                 -- 2047 characters</li>
  <li>3-byte character (<code>畀</code>, [0xE7, 0x95, 0x80])           -- 1365 characters</li>
  <li>4-byte character (<code></code>, [0xF0, 0x9D, 0x86, 0x8F])    -- 1023 characters</li>
  </ol>
  <p><strong>Chrome 36.0.1985.143</strong></p>
  <ol>
  <li>1-byte character (<code>1</code>, [0x31])                       -- 4094 characters</li>
  <li>2-byte character (<code>£</code>, [0xC2, 0xA3])                 -- 2047 characters</li>
  <li>3-byte character (<code>畀</code>, [0xE7, 0x95, 0x80])           -- 1364 characters</li>
  <li>4-byte character (<code></code>, [0xF0, 0x9D, 0x86, 0x8F])    -- 1023 characters</li>
  </ol>
  <p><strong>Opera 24.0.1558.17</strong></p>
  <ol>
  <li>1-byte character (<code>1</code>, [0x31])                       -- 4094 characters</li>
  <li>2-byte character (<code>£</code>, [0xC2, 0xA3])                 -- 2047 characters</li>
  <li>3-byte character (<code>畀</code>, [0xE7, 0x95, 0x80])           -- 1364 characters</li>
  <li>4-byte character (<code></code>, [0xF0, 0x9D, 0x86, 0x8F])    -- 1023 characters</li>
  </ol>
  <p><strong>IE 8.0.6001.19518</strong></p>
  <p>IE too relaxes the RFC limit to 5117 bytes per cookie, but also enforces a maximum cookies' size per domain limit (in this case, the limit found was 10234 characters)</p>
  <ol>
  <li>1-byte character (<code>1</code>, [0x31])                       -- 5115 characters</li>
  <li>2-byte character (<code>£</code>, [0xC2, 0xA3])                 -- 5115 characters</li>
  <li>3-byte character (<code>畀</code>, [0xE7, 0x95, 0x80])           -- 5115 characters</li>
  <li>4-byte character (<code></code>, [0xF0, 0x9D, 0x86, 0x8F])    -- 2557 characters</li>
  </ol>
  <h2>Note on IE:</h2>
  <p>IE seems to be using the ECMAScript's <em>notion</em> of characters. ECMAScript exposes characters as 16-bit unsigned integers (character encoding could be either UTF-16 or UCS-2 and is left as an implementation choice). The 4-byte character chosen for the tests uses two 16-bit code units in UTF-16. And since ECMAScript counts a 16-bit integer as a characer, <code>&quot;&quot;.length === 2</code> returns <code>true</code>.
  This leads <code></code> to be counted as two characters.</p>