Logging Into Facebook With Cookies: What They Are, What They Are Not, and the Handover Checklist
On this marketplace cookies are the normal delivery format for a Facebook account, not an edge case: they appear on 57 per cent of live listings. Here is what a session cookie actually gets you, why the listings that offer nothing else cost more rather than less, and the exact settings path to take ownership afterwards.
Sarah JohnsonBeing handed a block of cookies and no password feels like a mistake the first time. It is worth knowing how common it actually is before deciding what to do with them.
Counted across the live Facebook account listings on this site today, fifty-seven per cent mention cookies somewhere in the listing, and a third put them in the title. Cookies are not an unusual fallback here. They are the default delivery format, sitting alongside a login and password on most listings and standing alone on a handful.
That handful prices in a direction most people would not guess. Listings stating outright that a cookie is the only way in are not the cheap end of the shelf; they sit at about one and a half times the shelf median. Whatever a cookies-only account is, the market does not treat it as a discount.
What a cookie is, in the one sentence that matters
A cookie is not a credential. It is evidence that a login already happened.
When someone signs in normally, Facebook writes a few values into that browser. Every request afterwards carries them back, and Facebook reads them as "this session is already authenticated" rather than re-checking who you are. Copy those values into a different browser and that browser inherits the session. Nothing is bypassed and no security is defeated; you are continuing something that already exists.
Which is exactly why cookies are fragile in ways a password is not. A session ends when the account owner logs out of it, when Facebook decides something looks wrong, or when it simply expires. When that happens the cookie does not degrade or ask for a password. It stops working, and there is nothing to retry.
Two names come up constantly in this context, c_user and xs, and it is worth being straight about where they come from. They are what the browser's own storage view shows. Meta documents none of it: the cookie policy names no individual cookie and gives no technical account of any of them. Treat the names as operational folklore that happens to be reliable, not as anything you can point at a support page to justify.
Loading them, and the platform question the search results keep asking
People searching for this overwhelmingly ask "on what device". The honest answer is that this is a desktop browser procedure, and the mobile results are mostly noise.
By hand. Open facebook.com, open the browser developer tools, go to the storage or application panel, find the cookie list for the domain, and enter the values. It works and it is tedious. The two things that break it are a wrong domain and a wrong path, and neither produces an error message. The page simply stays logged out.
With a cookie editor extension. Anything that imports a JSON array is faster and much harder to get wrong, because the domain and path travel with the data instead of being retyped. The shape is a list of objects, each carrying a domain of .facebook.com, a path of /, a name and a value. Import, save, reload the page. If the session is alive you are in immediately.
The rules that decide whether it works are short. The domain has to include the leading dot, the path is almost always the site root, and names and values have to be exact, including any trailing characters a copy-paste can drop. If xs is absent or wrong, the rest of the set will not carry a session on its own.
On phones the extension route mostly does not exist, which is why the search suggestions fill up with standalone apps and installers. Those are third-party software asking to hold a live session for an account you care about, a considerably larger decision than the login itself. If the account matters, use a desktop browser.
Cookies and access tokens are not the same purchase
The other query people pair with this one is whether they want cookies or a token, and the price spread on our own shelf answers it better than an explanation would. Listings mentioning an access token sit at nearly three times the shelf median. Listings offering cookies in JSON form sit at less than a third of it. Nine to one, between two things people talk about interchangeably.
The reason is what each one reaches. A session cookie gets a browser into the interface a person uses. A token addresses the programmatic surface and keeps working where no browser is involved. Buyers who need automation pay for the second and cannot substitute the first, which is what the spread measures. If you were handed cookies and expected to drive an API, you did not get a cheaper version of the same thing. You got a different thing.
The first ten minutes, if the account is now yours
A cookie is temporary access by construction. If the intention is that you own the account rather than borrow a session, the handover is not finished until the credentials that outlive a session are yours, and none of it happens automatically.
One navigation caveat first, because it will otherwise waste your time. Meta is mid-migration and says so on its own help pages: you may see either Accounts Center or Meta Account settings as the place to manage account settings. The change-password article even carries its own fallback branch, telling you to select Password and security directly if Accounts Center is not there. So expect one of two layouts, and navigate by the section name rather than by the click count.
The path Meta documents runs: your profile picture, then Settings and privacy, then Settings, then Accounts Center, then Password and security. Almost everything below lives in that one section.
- End the other sessions. Under Password and security, open Where you're logged in, pick the account, then select all the devices and log them out. Do this deliberately rather than assuming a password change does it for you. Meta's change-password documentation says nothing at all about other devices, and the only thing it does document about ending sessions is that you do it yourself.
- Change the password. Password and security, then Change password, then choose the account.
- Set up two-factor authentication, in the same section. Then take the recovery codes: inside two-factor authentication, under how you get login codes, open Additional methods, then Recovery codes, then get new codes. Ten are issued. Generating a fresh set is what invalidates any set the previous holder kept, and this is the step people skip.
- Check the passkey list. A passkey is a separate sign-in route that lives on somebody's physical device, and one left behind is a way back in that a new password does not obviously close. Meta publishes no statement either way about what a password change does to an existing passkey, which is reason enough to look at the list yourself rather than assume. Removing one requires re-entering the password, so do it after you have set the password you control.
Order matters here. End sessions first, so that whoever else was inside is out before you start changing what they can see. Then password, then two-factor, then recovery codes, then passkeys.
What cookies cannot do for you
Holding a session is not holding an account, and the gap shows up precisely at the steps above. The password change asks for what you do not have. Removing a passkey re-authenticates. If cookies really are all that was handed over, you are a guest in that session for as long as it lasts, and every action that would make the access permanent sits behind a credential you were not given.
That is the test for whether a cookies-only handover is what you wanted. To run the account for a week, it is fine. To own it, cookies alone do not get you there, and the thing to negotiate before paying is the password and the mailbox, not the cookie format.
Where this sits with Facebook's terms
Worth stating plainly rather than leaving implied. Facebook's terms of service ask users not to share a password or give access to their Facebook account. That clause exists, it is not ambiguous, and it applies regardless of how the access was packaged or who agreed to hand it over.
What follows is a risk assessment rather than a procedure. Sessions obtained this way can be ended by Facebook at any point, an account can be restricted, and no appeal route starts from "I was given the cookies". Buyers doing this at scale treat every account as disposable and price the losses in. Treating a purchased account as infrastructure is taking a risk the platform announced in advance.
The Facebook account listings here disclose delivery format in the title, so cookies-only, cookies plus login, and token-bearing stock can be told apart before purchase rather than after. The Facebook account security overview covers the surrounding surface, and locking an account down properly covers the end state.
Frequently Asked Questions
Facebook’s terms of service ask users not to share a password or give access to their account, and that clause covers cookie handover as much as anything else. It does not matter that the previous holder agreed. The practical consequence is that a session obtained this way can be ended at any time with no appeal route, so treat cookie access as revocable rather than as ownership.
Most listings include both, and the cookie is the faster route in. Signing in with a password from an unfamiliar browser and network is exactly the pattern that triggers a checkpoint, whereas restoring an existing session usually does not. The password still matters, because it is what lets you take permanent control afterwards.
A cookie carries a browser session into the interface a person uses. A token addresses the programmatic surface and keeps working where no browser is involved. They are not substitutes, and the market prices them accordingly: on the Facebook listings here, token-bearing stock sits at close to three times the shelf median while cookies supplied as JSON sit at under a third of it.
No. A session either exists or it does not, and there is no partial state to repair. It ends when the previous holder logs out of it, when Facebook invalidates it, or when it simply expires. If the listing came with a login and password, use those; if it came with cookies only, the access is gone and the only route is back to the seller.
Not through the normal route. Cookie editor extensions are a desktop browser feature, which is why searches for this fill up with standalone apps and installers instead. Handing a live session for an account you care about to unvetted third-party software is a much bigger decision than the login itself. Use a desktop browser.
End the other sessions before anything else, under Accounts Center then Password and security then Where you are logged in, selecting all devices and logging them out. Then change the password, then set up two-factor authentication, then generate a fresh set of recovery codes so any set the previous holder kept stops working, then check the passkey list for anything you did not create.
Meta does not document that it does, and the change-password article says nothing about other devices at all. The only thing Meta documents about ending sessions is the manual route. Since an unverified assumption here means someone else keeps a live session, end the sessions explicitly instead of relying on the password change to do it.
Meta is migrating accounts and states on its own help pages that you may see either Accounts Center or Meta Account settings as the place to manage settings. The change-password article carries a fallback branch for exactly this. Navigate by the section name, Password and security, rather than by a fixed number of clicks.
Sarah Johnson
Digital marketing expert with 10+ years of experience in social media strategy. Passionate about helping businesses grow their online presence through effective marketing techniques.
