01
Landing visit
Your browser receives VISITOR_ID, a random first-party identifier. It does not contain your email, password or payment information.
Browser cookie learning lab
See how a browser remembers a visitor—securely.
This landing page creates a first-party visitor cookie when you arrive. Sign in to explore secure PHP sessions, active devices, masked cookie values and remote session revocation from one clean dashboard.
✓ Secure✓ HttpOnly✓ SameSite=Lax✓ No sensitive data in visitor cookie
Live browser state
Visitor cookie active
Cookie name
VISITOR_ID
Masked value
8e0ee7••••••••••••••4d55ea
ScopeFirst-party
Lifetime90 days
SecureYes
HttpOnlyYes
Refresh the page: the same browser keeps the same visitor ID until the cookie expires or you delete it.
1first-party visitor cookie
90dvisitor cookie lifetime
60mlogin idle timeout
30doptional remember-me
How it works
From first visit to authenticated session
The visitor cookie and login session have different jobs. This package lets you see both without exposing full authentication tokens.
02
Secure sign-in
After login, PHP creates a separate SECSESSID cookie that links the browser to a server-side authenticated session.
03
Active devices
Each signed-in browser is registered separately so you can view device details and revoke another session from the dashboard.
Built for learning safely
Security settings you can actually inspect.
Authentication values are masked in the dashboard. Passwords stay server-side as hashes, and the browser cookies use sensible security flags over HTTPS.
01
SecureCookies are sent over HTTPS.
02
HttpOnlyJavaScript cannot read the protected cookies.
03
SameSite=LaxReduces unnecessary cross-site cookie sending.
04
CSRF protectionSensitive form actions require a session token.
Ready to inspect it?