EverCookie To Produces Extremely Persistent Cookies in a Browser

Evercookie is a javascript API available that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they've removed standard cookies, Flash cookies (Local Shared Objects or LSOs), and others. Evercookie accomplishes this by storing the cookie data in several types of storage mechanisms that are available on the local browser. Additionally, if evercookie has found the user has removed any of the types of cookies in question, it recreates them using each mechanism available.

This tool allows webmasters to create extremely persistent cookies, which get stored in several different places through a variety of methods. This is a creation of Samy Kamkar, the former hacker who brought MySpace to a halt in 2007 after releasing a cross-site scripting worm on the platform.


Cookies have refer to small text files stored by websites inside browsers in order to identify logged in users. Since they can also be used to track visitors between visits, today's modern browsers simple privacy controls, that can be used to easily delete them. Evercookie is a proof-of-concept tool that does exactly that – it makes sure deleted cookies can be re-created if deleted by storing them in numerous places.


Specifically, when creating a new cookie, it uses the following storage mechanisms when available:
     - Standard HTTP Cookies
     - Local Shared Objects (Flash Cookies)
     - Storing cookies in RGB values of auto-generated, force-cached
        PNGs using HTML5 Canvas tag to read pixels (cookies) back out
     - Storing cookies in and reading out Web History
     - Storing cookies in HTTP ETags
     - Internet Explorer userData storage
     - HTML5 Session Storage
     - HTML5 Local Storage
     - HTML5 Global Storage
     - HTML5 Database Storage via SQLite

New version comes with ETag and userData support! With all the methods available, currently eight, it only takes one cookie to remain for most, if not all, of them to be reset again. Another interesting aspect about evercookie is that it can achieve its purpose accross different browsers. If the the LSO cookie version is not deleted, it can be used to replicate in all locations inside a clean browser. For more details and creating an evercookie visit EverCookie home page.