Program file
cookies.sqlite: where Firefox keeps its cookies, and whether you can delete it
cookies.sqlite is the database in which Mozilla Firefox stores cookies. It sits in your Firefox profile folder and is safe. Deleting it only signs you out of websites. A cookies.sqlite outside a Firefox profile, or on a PC without Firefox, is the one worth checking.
Prefer to check it yourself? The manual checks follow.
A cookies.sqlite inside a Firefox profile folder is a normal Firefox data file. It is not a program and cannot run by itself. Deleting it is harmless to Windows: Firefox creates a new, empty one the next time it starts.
Malware can use any file name, so a cookies.sqlite in an unrelated folder, or on a PC where Firefox was never installed, deserves a scan. The cost of deleting the genuine file is only that you are signed out of websites and lose site preferences kept in cookies.
- Program
- Mozilla Firefox web browser
- Publisher
- Mozilla
- File type
- SQLite database holding cookies (not a program, no digital signature)
- Genuine folder
- The Firefox profile folder, on Windows under %APPDATA%\Mozilla\Firefox\Profiles\ in a subfolder with a random name such as xxxxxxxx.default-release
- Created
- When Firefox is installed and first started; the file is created in each profile
- Companion files
- cookies.sqlite-wal and cookies.sqlite-shm, temporary files SQLite adds while Firefox is open
- Can it be deleted?
- Yes, with Firefox closed. You are signed out of sites and lose cookie-based preferences
- Startup
- None. The file is only read and written by Firefox
What cookies.sqlite is
cookies.sqlite is the cookie store of Mozilla Firefox. A cookie is a small piece of information that a website sends to your browser, and the browser keeps it and sends it back on later visits. When you install Firefox and start it, this file is created in your profile folder. The old page said the file is created when Mozilla is installed, and that is where it comes from.
The cookies kept here can include login and session data, which keeps you signed in to a website, and preferences such as your language or location. A site can also put personal details in a cookie if you gave them to it, such as a name, address or telephone number, which is why the file is a privacy matter. Saved passwords are not kept in cookies.sqlite: Firefox keeps those in a separate store of its own.
The old page called cookies.sqlite a shared-memory file created by the browser at each start and deleted when it closes. That describes the companion cookies.sqlite-shm file, not cookies.sqlite. The main database is permanent: it stays between sessions, which is how a site can recognise you after you restart Firefox. Cookie changes are first written to the temporary cookies.sqlite-wal file and merged into the main file later.
The file is a database, not a program. It cannot be run, it has no startup entry and it is not signed. The old page described it as crucial for storing cookies, and that is true while you use Firefox: without it Firefox starts a new empty one.
How to check cookies.sqlite
The folder shows whether the file belongs to Firefox. The name alone proves nothing, because malware can borrow any file name.
- Find the folder. Open Firefox, type about:support in the address bar and next to Profile Folder choose Open Folder. On Windows this is under %APPDATA%\Mozilla\Firefox\Profiles\. A cookies.sqlite in that folder is the genuine one.
- Check where a stray copy is. If you found a cookies.sqlite somewhere else, for example in Downloads, a temporary folder or a folder with no Firefox profile files next to it, look at what sits beside it. A real profile folder also holds places.sqlite, prefs.js and other Firefox files. A lone file with a Firefox name and no Firefox on the PC is suspicious.
- Look at the size. The file can grow large, especially in old profiles. The old page said it can reach a big size and take up space. A big size is not a sign of infection.
- Remember what the file can do. A database file does not run, so it cannot infect anything by sitting on the disk. Malware can borrow the name, hide an executable under it, or read the genuine file to steal sessions, so the question is what runs, not what the file is called.
- Scan the PC if the file looks wrong. Run a full scan and an offline scan with Microsoft Defender (Windows Security > Virus & threat protection > Scan options). Do not delete the file first: diagnose it, as the old page advised.
A cookies.sqlite in the right profile folder is Firefox's own. That does not show that nothing else on the PC is infected, so scan as well if you have other signs.
Do you need cookies.sqlite?
You do not need to keep it, and you do not need to delete it. Delete it only if you want to clear all cookies at once, and do it through Firefox rather than by hand where you can. The old page said not to go straight to deleting the file, since it is the store Firefox uses for cookies.
- Clear cookies from inside Firefox. Open Settings > Privacy & Security > Cookies and Site Data and choose Clear Data, or Manage Data to remove cookies for one site only. The old page gave an older Tools > Options > Security path that Firefox no longer uses. This empties the cookie store and stops cookies from tracking you.
- Clear cookies at every close, if you want to. In the same section, tick “Delete cookies and site data when Firefox is closed”. This is what people mean when they clean the file after each browsing session.
- Delete the file only with Firefox closed. Close Firefox completely, then delete cookies.sqlite from the profile folder. This does no damage to Windows. The only effect is that some accounts or pages sign you out, because the cookies are gone. Firefox makes a new file at the next start.
- If the file is part of an infection. If you suspect malware, do not delete this one file and stop. Run a full scan and an offline scan with Microsoft Defender and let it remove what it finds, because malware that uses this name has other components. Then check Task Manager > Startup apps and Task Scheduler for entries you did not create.
- Uninstall Firefox if you no longer use it. Open Settings > Apps > Installed apps, select Mozilla Firefox and choose Uninstall. The profile folder, with cookies.sqlite, stays in %APPDATA%\Mozilla\Firefox until you delete it.
Warning signs
| What you see | What it means |
|---|---|
| cookies.sqlite in a folder that is not a Firefox profile | Not Firefox's cookie store. The old page warned that malware can be named anything, and may borrow this name to prevent its removal. |
| cookies.sqlite on a PC where Firefox was never installed | Firefox did not make it. Check where it came from and scan the PC. |
| A cookies.sqlite that is, or comes with, an .exe, .scr or script, or a file that runs | A database does not run. This is a different file under a borrowed name. |
| Slowdowns, damaged programs, files infected or a leak of private data | The old page listed these as what a parasite can do with a file that is not the genuine one. They point to malware on the PC, not to the cookie file. |
| You did not give any site your personal details, yet cookies hold them | The old page noted the file might store personal details such as a name, address or telephone number. A website can only put there what you gave it, so this leads to privacy problems, not to infection. Clear cookies in Firefox. |
| The file or Firefox appeared after an email attachment, a bogus software download, an update from an odd site or an infected file | The old page named these as the ways a fake file arrives. Pay attention to who sent the email and to the sites you land on. |
Everyday problems
What are cookies.sqlite-wal and cookies.sqlite-shm?
They are temporary files that SQLite creates beside cookies.sqlite while Firefox works with the database. The -wal file is the write-ahead log, where changes are written first. The -shm file is shared memory for the log. The old page said Firefox creates both while it works with SQLite databases such as cookies.sqlite.
When you exit Firefox, it should merge the log into the main file and remove the two temporary files.
The -wal and -shm files are still there after Firefox closed. What now?
This does not happen every time, but it does happen. The old page said Firefox may be having a problem with these files, such as a file permissions problem or a file lock, for example when Firefox did not close cleanly or another program holds the file.
If they are still there after the browser has closed completely, you can delete them. Check in Task Manager that no firefox.exe is still running first. Deleting cookies.sqlite-wal can lose the cookie changes that were not merged yet, so you may be signed out of a site.
Can I delete cookies.sqlite because it is too big?
Yes. The old page said the file can come up to a big size and take up space, and that removing it does no damage to Windows. Close Firefox first. You will be signed out of sites and cookie-based preferences go. Clearing cookies in Firefox settings does the same without touching files.
Questions people ask
Is cookies.sqlite a virus?
No. cookies.sqlite is the file in which Mozilla Firefox stores its cookies, and it is a database, not a program. The only reason to doubt it is when it is outside a Firefox profile folder or on a PC without Firefox, because malware can use any file name. In that case, scan with Microsoft Defender and look at what else sits in the folder.
Is it safe to delete cookies.sqlite?
Yes, with Firefox closed. Windows is not damaged. Firefox creates a new empty file the next time it starts. The only effect is that you are signed out of websites and lose preferences that were kept in cookies. For a cleaner way, use Settings > Privacy & Security > Cookies and Site Data in Firefox.
Where is cookies.sqlite on Windows?
It is in your Firefox profile folder, under %APPDATA%\Mozilla\Firefox\Profiles\ in a folder with a random name such as xxxxxxxx.default-release. The quickest way is to open about:support in Firefox and choose Open Folder next to Profile Folder. Each Firefox profile has its own cookies.sqlite.
Does cookies.sqlite store my passwords?
No. Cookies hold session data, login state and preferences, not saved passwords. Firefox keeps saved logins in a separate store. The old page said removing the file also removes saved passwords, and that is not right: deleting cookies.sqlite signs you out of sites, and your saved logins stay. A cookie can still hold personal details a site put in it.
Why does cookies.sqlite keep growing?
Every website that sets a cookie adds a row, and rows for sites you no longer visit stay until they expire or you clear them. An old profile can therefore hold a large file. That is normal and not a sign of infection. Clear cookies in Firefox, or choose to delete them each time Firefox closes.
Can malware use the name cookies.sqlite?
Yes. Any malware can be named anything, and the old page warned that a fake may use a trusted name to avoid removal or to slip past security tools. Such a file usually arrives with an email attachment, bogus software, a fake update or an infected download. If you suspect it, scan with Microsoft Defender rather than only deleting the file, since other components can be present.
Sources
- Mozilla Support: Profiles, where Firefox stores your bookmarks, passwords and other user data
- Mozilla Support: Clear cookies and site data in Firefox
- SQLite: Write-Ahead Logging
- MITRE ATT&CK: Masquerading, T1036
Version data read on Oct 6, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…