Connexion par cookie et jeton Facebook sur ordinateur : ce qui est ignoré, et quoi corriger ensuite

Managing eight Facebook accounts from one desktop, typing a password and a code into each one every time a session drops, gets old fast. That is the problem session-based logins solve: import a cookie or token once and the browser profile stays signed in without repeating the password step.

It works. It is also not the same thing as logging in, and treating it as though it were is what causes the trouble later.

What a cookie or token login actually is

When you log in normally, Facebook hands your browser a session cookie: a string that proves you already authenticated, so you are not asked for a password on every page. A token does a similar job for apps and tools that talk to Facebook's systems on your behalf.

Importing one of those strings into a fresh browser profile tells that profile to treat the session as already established, skipping the password and the two-factor screen entirely. Whoever holds the string has the access, and Facebook has no way to distinguish the rightful holder skipping the login screen from anyone else who obtained the same string. From the platform's side, a leaked session is indistinguishable from a leaked password.

This is worth internalising before the setup steps, because it is the reason every recommendation below exists.

Setting up a session import on desktop

The common arrangement is a Chromium-based browser with a separate profile per account, plus an extension that can write session data into it. The flow:

1. Create a fresh browser profile dedicated to exactly one account. Mixing accounts in one profile is what produces most cross-contamination flags.
2. Install a cookie or token import extension from the browser's official extension store.
3. Paste the cookie string and token into the extension's import fields, along with the matching user agent if the tool asks for one.
4. Confirm the import. The profile should load the account without showing a login screen.

One profile, one account, one stable connection. That last part is where a lot of guides, including the earlier version of this one, hand out advice that does not survive contact with the shelf it points at. See the note near the end before you go shopping for it.

Why the risk profile is different from a password login

A password lives in your head or a password manager. A session string lives in a file or an extension's storage, and if that machine or that extension is compromised, so is every account whose session sits there.

Factor	Password and 2FA login	Cookie or token import
Speed of setup	Slower, manual entry each time	Fast, one import per profile
Where the secret lives	Your memory or a password manager	A browser extension or a local file
When the session ends	You can re-authenticate yourself	You cannot, unless you also hold the credentials
If the device is compromised	The second factor still stands in the way	The session is usable immediately, no second factor
Revocation	Change the password, sessions drop	Same, but only if you can log in to do it

The third row is the one people get backwards. It is not that password sessions never expire and imported ones do, because both are sessions and both end. The difference is what happens when they end. With credentials you log in again. With an imported string and nothing else, you are locked out of an account you were using ten minutes ago.

Securing a handed-over account, in order

A session import is a reasonable way to get in the first time, particularly on an account you have just acquired. It is not a long-term arrangement. Work through these in sequence, because two of the steps do nothing if you do them in the wrong order.

1. Change the password. Under Accounts Center, then Password and Security. If your settings are still on the older layout you will find the same screen there; Meta is midway through moving people from Accounts Center to Meta Accounts and says you may see either.
2. Log in with the new password directly, through the normal login screen, once, without the imported session. If that does not work you have not actually taken control of anything yet.
3. Check for an existing passkey and remove it. This is the step almost every guide on the topic still omits, and it is the one that undoes the two above. Facebook added passkeys in 2025, and a passkey lets its holder into the account without ever entering a password. If the previous holder set one up on their device, your password change did not lock them out. Look under Accounts Center, then Password and Security, then Passkey, and remove anything you did not create. Some listings on this marketplace advertise a passkey as part of the delivery, so this is not a theoretical concern.
4. Turn on two-factor authentication, on the same screen, and prefer an authenticator app over SMS.
5. Generate recovery codes. Ten of them, single use, available only once two-factor is on. Save them somewhere that is not the machine holding your session files.
6. End every other session. Open the Activity Log and go to Where you're logged in. This section moved out of the old security menu, which is why older guides send you to a place that no longer exists. End anything that is not you, including the original session the account arrived on.

Reading what a listing actually includes

Delivery formats vary more than anything else on this shelf, and the listing text is the only place the format is declared before purchase. Across the live Facebook account listings on HstockPlus, most mention two-factor authentication, a little over half mention a cookie, roughly a fifth mention a token, and a smaller group mention a matching user agent. A handful mention a passkey.

Those distinctions matter in practice. A cookie without a matching user agent is more likely to trip an extra check on import. A listing that mentions two-factor is telling you the seller holds a second factor you will need to replace. A listing that mentions a passkey is telling you about step three above. It is worth comparing what each one says it includes rather than assuming a category-wide standard exists, because it does not.

For contrast, the Telegram account shelf is built on an entirely different convention: most of those listings are delivered as tdata or a session file and almost none of them involve cookies at all. Do not carry assumptions from one platform's shelf to another's.

Keeping several accounts apart

Once several accounts run on one desktop, the biggest ongoing risk stops being the import method and becomes profiles bleeding into each other. Keep one account per profile, never copy cookies between profiles to test something, and check the session list on each account periodically.

On the network side, a correction to advice this article previously gave. Pointing readers at a residential proxy per profile was too glib about what is actually on the proxy shelf. It is 83 live listings and by title text more than a third of them are consumer VPN subscriptions, which is close to the opposite of what a per-account setup needs: a shared exit address used by everyone else on that server. The residential subcategory is twenty listings, and even inside it a couple describe server or datacenter address ranges. If a stable per-account address is what you are buying, read the listing text and confirm it says so rather than trusting the shelf name.

Consistency is what actually matters. An account that appears from the same profile, the same rough location and the same fingerprint every time draws far less attention than one bouncing between environments, and that is achievable with or without anything bought.

Meta's Security Tips and Features hub is where the settings paths above are documented and where they will change next. Its Business Help Center covers the role and permission side for team-run accounts.