Updating a cookie means writing again with the same name, same path (and domain, if used). There is no separate updateCookie() API — every update is another document.cookie assignment that overwrites the matching entry.
Warning Lifetime on update
If you omit max-age / expires when updating, a persistent cookie becomes a session cookie. Re-send lifetime whenever you want it to stay.
Remember
// create
document.cookie = "theme=light; path=/; max-age=2592000"
// update (same name + path + lifetime attrs)
document.cookie = "theme=dark; path=/; max-age=2592000"
same name + path → overwrite
different path → duplicate cookie
no max-age/expires → becomes session
Goal
Prefer
Change value
Rewrite same name + path
Extend lifetime
Rewrite with new max-age
Keep persistence
Always re-send max-age/expires
Avoid duplicates
Never change path by accident
Approach
How to Update Cookies
Match the cookie identity, rewrite the value, and re-apply path and lifetime.
Identify the cookie: same name, same path (usually /), same domain if set.
Assign a new document.cookie string with the new value.
Re-send max-age or expires if the cookie should stay persistent.
Verify with document.cookie or DevTools — a wrong path creates a second cookie.
Piece
Required?
Role
Same name
Yes
Targets the cookie to replace
Same path
Yes
Completes the cookie identity
New value
Usual
What you want stored after update
max-age / expires
If persistent
Keeps lifetime from becoming session
Pseudocode
Pseudocode
name, newValue = update target
path = original path // usually "/"
seconds = original lifetime // or new duration
cookie = name + "=" + encode(newValue)
cookie += "; path=" + path
if seconds is a number:
cookie += "; max-age=" + seconds
document.cookie = cookie // overwrite if identity matches
Reference
Cheat Sheet
Keep these update rules handy.
Topic
Detail
API
Same as write: document.cookie = …
Identity
name + path (+ domain)
Overwrite
Matching identity replaces the old value
Mismatch
Different path → duplicate cookie
Omit lifetime
Becomes a session cookie
Sliding session
Rewrite same value + fresh max-age
HttpOnly
Not updatable from JavaScript
Try it
Live Preview
Seed a theme cookie, then update its value while keeping path=/ and a 30-day max-age.
Uses path=/ and max-age=2592000 (30 days) on every write so updates overwrite instead of duplicating.
Result
Click “Seed theme=light”, then choose a value and “Update theme”.
document.cookie → (current jar)
Code
JavaScript Examples
Short, copy-ready snippets. Open DevTools Console, or use Try It Yourself for a live editor.
Example 1 — Update a Cookie Value
Change username from JohnDoe to JaneDoe with the same path and lifetime.
Store a default. Initial write saves theme=light for 30 days.
Toggle with a helper.setTheme("dark") rewrites the value.
Keep path and lifetime. Same path=/ and max-age prevent session downgrade.
Common pattern. Preferences like theme and language update this way.
Example 4 — Path Mismatch Creates a Duplicate
See why an “update” fails when path does not match the original cookie.
JavaScript
document.cookie = "username=JohnDoe; max-age=604800; path=/";
// Intended update — but path differs
document.cookie = "username=JaneDoe; max-age=604800; path=/account";
console.log(document.cookie);
// May show BOTH username cookies
Write with another path.path=/account is a different identity.
Two cookies exist. Name alone is not enough — path completes the key.
Fix. Reuse the original path, or delete the old cookie first — see Cookie Path.
Edge Cases & Pitfalls
Check these before shipping cookie update logic.
trap
Update without lifetime
Omitting max-age/expires turns a persistent cookie into a session cookie.
path
Path mismatch duplicates
A different path creates a second cookie instead of overwriting. Match path every time.
HttpOnly
HttpOnly is server-only
Scripts cannot read or update HttpOnly cookies. Use Set-Cookie on the server.
encode
Encode values on rewrite
Spaces and punctuation still need encodeURIComponent when you update — same rules as write.
Compatibility
Browser Support
Updating cookies uses the same document.cookie setter available in every browser that supports cookies in JavaScript.
✓ Baseline · DOM
document.cookie (update)
Supported across Chrome, Firefox, Safari, Edge, and legacy IE. Overwrite rules (name + path + domain) are consistent; verify in DevTools when duplicates appear.
99%Universal API
Google ChromeAll versions · Desktop & Mobile
Full support
Mozilla FirefoxAll versions · Desktop & Mobile
Full support
Apple SafariAll versions · macOS & iOS
Full support
Microsoft EdgeAll versions · Chromium & Legacy
Full support
Internet ExplorerIE 6+ · Legacy environments
Full support
OperaAll modern versions
Full support
document.cookieExcellent
Bottom line: Safe for production. Treat every update as a full rewrite of value + path + lifetime attributes.
Analysis
Performance Notes
Operation
Cost
Best for
One update write
O(1) assign
Preference / session refresh
Update on every keystroke
Unnecessary I/O
Debounce or update on commit
Many large cookies
Header bloat
Keep values small; prefer localStorage for client-only data
Updates are cheap as assignments, but cookies ride on matching requests. Refresh max-age on meaningful activity, not on every tiny UI event.
Remember
Key Takeaways
Role: an update is a rewrite with the same name + path (+ domain).
Lifetime: re-send max-age/expires or you get a session cookie.
Sliding sessions: rewrite the same value with a fresh max-age.
One line: update by rewriting with the same name and path — and always re-attach the lifetime you still want.
Frequently Asked Questions
Assign a new document.cookie string with the same cookie name and the same path (and domain, if you set one). The browser replaces the matching entry instead of creating a separate cookie.
Browsers identify cookies by name + domain + path. Writing username=Jane with path=/account does not update username=John at path=/ — you get two cookies that share a name but differ in scope.
It becomes a session cookie and is removed when the browser session ends, even if the old version was persistent. Always re-send lifetime attributes when you want persistence.
Yes. Write the same name and value again with a new max-age or expires. Many apps refresh session cookies on activity this way.
No. HttpOnly cookies are invisible to document.cookie. Only the server can change them through Set-Cookie response headers.
Yes. Both use document.cookie assignment. An update is a write where name/path/domain match an existing cookie, so the browser overwrites instead of adding a sibling.