Cookies PWA Demo

Demo

1. Install the app on your device.
2. Enter a value to save as cookie and hit Save.
   Save cookie
3. Refresh the page and click the button below to retrieve the cookie you've saved
   Get saved cookie
4. Check the code of this simple cookie demo below.

Cookies are essential to the web

Cookies work consistently across all browsers and operating systems. Contrary to popular belief, cookies are not inherently “bad.” While they have been misused by advertisers to track users across websites, cookies remain an essential part of the web. They enable data to persist on a user's device—without them, many core web features simply wouldn't function.

Cookies in PWAs vs websites

PWAs don't have a special cookie mechanism. They rely entirely on standard browser cookie behavior:

• document.cookie for setting and retrieving cookies
• Cookie attributes (Secure, SameSite, Path, HttpOnly, Expires)
• Cookies automatically included in network requests (depending on SameSite rules)

So a PWA and the browser technically use the exact same origin-based cookie system. There's quite literally no difference in how it works under the hood.

Does a PWA and the browser share cookies?

Cookies in iOS PWAs

On iOS, an installed PWA runs in a separate storage partition from Safari. As a result, logging in through the browser won't log you into the installed PWA (and vice versa). There is one exception: iOS performs a one-time cookie copy at the moment the app is added to the home screen.

Cookies in Android/Desktop PWAs

On Android and Desktop, a PWA and the browser it was installed from share the same cookie store, so user sessions remain consistent across both.

Can a PWA's service worker access cookies?

A service worker cannot directly read or write cookies because it has no access to document.cookie or other DOM APIs. However, cookies are still automatically included in network requests the service worker handles, as long as the request includes credentials (e.g., credentials: 'include') and the cookie's SameSite rules allow it. So while the service worker can't inspect cookies directly, it can still operate on requests and responses that contain them.

What's the maximum size of a cookie?

The maximum size of a single cookie is generally around 4 KB, which includes the cookie's name, value, and all attributes (like Path or Domain).

• Browsers typically allow around 20 to 50 cookies per domain.
• If a cookie exceeds the size limit, it may be truncated or ignored.
• For storing larger amounts of data in web apps or PWAs, use localStorage or IndexedDB instead.

What's cookie purging?

Cookie purging is when the browser cleans up old cookies and site data, usually because a site hasn't been used for a while or the browser wants to free up space. This can lead to surprise logouts or lost sessions. On iOS, Safari removes site data after 7 days of inactivity, but installed PWAs don't have this limit and their data isn't purged.

Code