Cookies

What it's for

The Cookies tab on an Account answers three questions a single number never could: which sites this Account has a session with, when each of those sessions dies, and whether one of them can be handed to another Account.

It opens on the sites, biggest first, each on one line: the site, how many cookies it holds, and the soonest of them to expire. Open a site to see its cookies by name, with the same expiry and a cross to remove any one of them. Eight sites are listed until you ask for the rest, because a warmed Account has over a hundred.

No cookie's value is ever shown

The panel carries a cookie's name, its site, its flags and its expiry. It never carries the value, and the value is the part that is the credential. That is a property of the data the screen is given, not a masking trick on top of it.

The one place a value moves is Move cookies between machines, the export and import tool below the list. That is an explicit click by you, into your own clipboard.

Clearing

Each site has its own Clear, which signs this Account out of that site and leaves every other site alone. The button at the bottom of the tab still clears the whole Account.

Both ask first, and both name what they are about to do.

Handing one site to another Account

Copy this site to… takes one site's session and gives it to another Account. Pick the Account, press Copy, and read the confirmation before you accept it.

The destination's own cookies for that site are replaced. Everything else it holds is untouched, so a copy cannot quietly empty its other logins.

What a hand-over leaves behind

When you copy a site, bot-management cookies stay where they were earned. These are the sensor cookies a site's protection layer issues — Akamai, PerimeterX, DataDome, Cloudflare, Kasada, Imperva and their kin — and they are bound to the browser that earned them.

Carrying one into a second browser contradicts that browser's Fingerprint. Worse, the same sensor cookie arriving on two Accounts is the plainest statement available that those Accounts are one machine. So the copy leaves them behind and tells you how many stayed. Each browser earns its own.

A whole-jar import (Move cookies between machines) is different: it restores the jar exactly as it was exported, sensor cookies included, and a cookie that belonged to one exact address comes back on that address alone rather than spreading to its subdomains. Import a jar back into the Account it came from, not into a different one.

The site list says the same thing before you act: "170 of 172 would travel."

Where these cookies live

In the Account's own sealed session on this machine, never in Umbra's vault and never in your sync. The same is true of the separate jar the second browser keeps when you open an Account in Chromium. Settings › Your data on this machine names both locations.