Fazer login no Facebook com cookies: o que eles são, o que não são, e o checklist para a transferência

Being handed a block of cookies and no password feels like a mistake the first time. It is worth knowing how common it actually is before deciding what to do with them.

Counted across the live Facebook account listings on this site today, fifty-seven per cent mention cookies somewhere in the listing, and a third put them in the title. Cookies are not an unusual fallback here. They are the default delivery format, sitting alongside a login and password on most listings and standing alone on a handful.

That handful prices in a direction most people would not guess. Listings stating outright that a cookie is the only way in are not the cheap end of the shelf; they sit at about one and a half times the shelf median. Whatever a cookies-only account is, the market does not treat it as a discount.

What a cookie is, in the one sentence that matters

A cookie is not a credential. It is evidence that a login already happened.

When someone signs in normally, Facebook writes a few values into that browser. Every request afterwards carries them back, and Facebook reads them as "this session is already authenticated" rather than re-checking who you are. Copy those values into a different browser and that browser inherits the session. Nothing is bypassed and no security is defeated; you are continuing something that already exists.

Which is exactly why cookies are fragile in ways a password is not. A session ends when the account owner logs out of it, when Facebook decides something looks wrong, or when it simply expires. When that happens the cookie does not degrade or ask for a password. It stops working, and there is nothing to retry.

Two names come up constantly in this context, c_user and xs, and it is worth being straight about where they come from. They are what the browser's own storage view shows. Meta documents none of it: the cookie policy names no individual cookie and gives no technical account of any of them. Treat the names as operational folklore that happens to be reliable, not as anything you can point at a support page to justify.

Loading them, and the platform question the search results keep asking

People searching for this overwhelmingly ask "on what device". The honest answer is that this is a desktop browser procedure, and the mobile results are mostly noise.

By hand. Open facebook.com, open the browser developer tools, go to the storage or application panel, find the cookie list for the domain, and enter the values. It works and it is tedious. The two things that break it are a wrong domain and a wrong path, and neither produces an error message. The page simply stays logged out.

With a cookie editor extension. Anything that imports a JSON array is faster and much harder to get wrong, because the domain and path travel with the data instead of being retyped. The shape is a list of objects, each carrying a domain of .facebook.com, a path of /, a name and a value. Import, save, reload the page. If the session is alive you are in immediately.

The rules that decide whether it works are short. The domain has to include the leading dot, the path is almost always the site root, and names and values have to be exact, including any trailing characters a copy-paste can drop. If xs is absent or wrong, the rest of the set will not carry a session on its own.

On phones the extension route mostly does not exist, which is why the search suggestions fill up with standalone apps and installers. Those are third-party software asking to hold a live session for an account you care about, a considerably larger decision than the login itself. If the account matters, use a desktop browser.

Cookies and access tokens are not the same purchase

The other query people pair with this one is whether they want cookies or a token, and the price spread on our own shelf answers it better than an explanation would. Listings mentioning an access token sit at nearly three times the shelf median. Listings offering cookies in JSON form sit at less than a third of it. Nine to one, between two things people talk about interchangeably.

The reason is what each one reaches. A session cookie gets a browser into the interface a person uses. A token addresses the programmatic surface and keeps working where no browser is involved. Buyers who need automation pay for the second and cannot substitute the first, which is what the spread measures. If you were handed cookies and expected to drive an API, you did not get a cheaper version of the same thing. You got a different thing.

The first ten minutes, if the account is now yours

A cookie is temporary access by construction. If the intention is that you own the account rather than borrow a session, the handover is not finished until the credentials that outlive a session are yours, and none of it happens automatically.

One navigation caveat first, because it will otherwise waste your time. Meta is mid-migration and says so on its own help pages: you may see either Accounts Center or Meta Account settings as the place to manage account settings. The change-password article even carries its own fallback branch, telling you to select Password and security directly if Accounts Center is not there. So expect one of two layouts, and navigate by the section name rather than by the click count.

The path Meta documents runs: your profile picture, then Settings and privacy, then Settings, then Accounts Center, then Password and security. Almost everything below lives in that one section.

• End the other sessions. Under Password and security, open Where you're logged in, pick the account, then select all the devices and log them out. Do this deliberately rather than assuming a password change does it for you. Meta's change-password documentation says nothing at all about other devices, and the only thing it does document about ending sessions is that you do it yourself.
• Change the password. Password and security, then Change password, then choose the account.
• Set up two-factor authentication, in the same section. Then take the recovery codes: inside two-factor authentication, under how you get login codes, open Additional methods, then Recovery codes, then get new codes. Ten are issued. Generating a fresh set is what invalidates any set the previous holder kept, and this is the step people skip.
• Check the passkey list. A passkey is a separate sign-in route that lives on somebody's physical device, and one left behind is a way back in that a new password does not obviously close. Meta publishes no statement either way about what a password change does to an existing passkey, which is reason enough to look at the list yourself rather than assume. Removing one requires re-entering the password, so do it after you have set the password you control.

Order matters here. End sessions first, so that whoever else was inside is out before you start changing what they can see. Then password, then two-factor, then recovery codes, then passkeys.

What cookies cannot do for you

Holding a session is not holding an account, and the gap shows up precisely at the steps above. The password change asks for what you do not have. Removing a passkey re-authenticates. If cookies really are all that was handed over, you are a guest in that session for as long as it lasts, and every action that would make the access permanent sits behind a credential you were not given.

That is the test for whether a cookies-only handover is what you wanted. To run the account for a week, it is fine. To own it, cookies alone do not get you there, and the thing to negotiate before paying is the password and the mailbox, not the cookie format.

Where this sits with Facebook's terms

Worth stating plainly rather than leaving implied. Facebook's terms of service ask users not to share a password or give access to their Facebook account. That clause exists, it is not ambiguous, and it applies regardless of how the access was packaged or who agreed to hand it over.

What follows is a risk assessment rather than a procedure. Sessions obtained this way can be ended by Facebook at any point, an account can be restricted, and no appeal route starts from "I was given the cookies". Buyers doing this at scale treat every account as disposable and price the losses in. Treating a purchased account as infrastructure is taking a risk the platform announced in advance.

The Facebook account listings here disclose delivery format in the title, so cookies-only, cookies plus login, and token-bearing stock can be told apart before purchase rather than after. The Facebook account security overview covers the surrounding surface, and locking an account down properly covers the end state.