JavaScript Cookie Expires

What Are expires and max-age?

Cookie lifetime attributes tell the browser how long to keep a cookie. Omit both for a session cookie; set expires (UTC date) or max-age (seconds) for a persistent cookie. Prefer max-age for new code.

document.cookie = "name=value; path=/; max-age=SECONDS"
document.cookie = "name=value; path=/; expires=" + date.toUTCString()

no expires / max-age  → session cookie
max-age=0             → delete (same path)
both set              → max-age wins

How to Use Cookie Lifetime

Pick a lifetime style, write one cookie assignment, and re-send lifetime on every update.

1. Decide session (omit lifetime) vs persistent (max-age or expires).
2. Prefer max-age in seconds — avoid timezone mistakes with date strings.
3. Always include the same path (usually path=/) when setting or deleting.
4. On update, re-send max-age/expires or the cookie becomes a session cookie.

Pseudocode

name, value = cookie data
seconds = lifetime in seconds   // or null for session

cookie = name + "=" + encode(value) + "; path=/"

if seconds is a number:
    if seconds <= 0:
        cookie += "; max-age=0"     // delete
    else:
        cookie += "; max-age=" + seconds

document.cookie = cookie           // one cookie per assignment

Cheat Sheet

Keep these lifetime facts handy while writing cookies.

Live Preview

Pick a lifetime mode. The demo builds a document.cookie assignment and can apply it in this browser.

mode = session
assignment =
  document.cookie = "ctfDemo=ok; path=/; SameSite=Lax"

/* no expires / max-age → session cookie */
document.cookie → (current jar)

JavaScript Examples

Short, copy-ready snippets. Open DevTools Console, or use Try It Yourself for a live editor.

const date = new Date();
date.setTime(date.getTime() + 7 * 24 * 60 * 60 * 1000);

document.cookie =
  "username=" + encodeURIComponent("JohnDoe") +
  "; expires=" + date.toUTCString() +
  "; path=/; SameSite=Lax";

console.log(document.cookie);

username=JohnDoe

const sevenDays = 7 * 24 * 60 * 60; // 604800

document.cookie =
  "prefs=compact; max-age=" + sevenDays + "; path=/; SameSite=Lax";

// Sliding refresh — rewrite to restart the countdown
document.cookie =
  "prefs=compact; max-age=" + sevenDays + "; path=/; SameSite=Lax";

console.log(document.cookie);

prefs=compact

document.cookie = "flashBanner=dismissed; path=/; SameSite=Lax";

// No max-age or expires → session cookie
console.log(document.cookie);

flashBanner=dismissed

document.cookie = "username=JohnDoe; max-age=604800; path=/; SameSite=Lax";

function deleteCookie(name) {
  document.cookie = name + "=; path=/; max-age=0";
}

deleteCookie("username");
console.log(document.cookie); // username gone

(empty or other cookies only)

Performance Notes

Lifetime attributes themselves are cheap. The cost is cookies riding on every matching request — keep durations short and values small. For client-only data, consider localStorage instead of long-lived cookies.

Key Takeaways