Cookies live on the client

For all page requests (in other words, every time you visit a web page), your browser (the client) compares the web page's URL to the cookies in the "cookie jar" and sends all the unexpired cookies that match the domain and path.

The total size of a cookie must be less than 4KB. In practice, it's usually only a few bytes.

The client may hold up to 20 cookies for a given domain, and up to 300 cookies total.

A request might carry more than one cookie.

Your browser can also add cookies to the cookie jar; it doesn't have to come from the server.