Skip to main content
Cookie reference · Stripe

The __stripe_sid cookie

A 30-minute Stripe.js session cookie used in Stripe's fraud risk checks during one browsing session.

__stripe_sid at a glance

Cookie name
__stripe_sid
Vendor
Stripe
Category
Security and fraud prevention
Party
First-party
Typical duration
30 minutes
Set on
.<your-domain>
Value format
Opaque identifier (format not documented by vendor)
Name match
Exactly __stripe_sid

What the __stripe_sid cookie does

Stripe.js sets __stripe_sid for fraud prevention. It holds a short-lived session identifier that helps Stripe assess the risk of an attempted transaction within one browsing session.

Stripe documents a 30 minute lifetime and gives its domain as the site that loads Stripe.js. It's paired with __stripe_mid, the longer-lived device identifier.

What TagPipes observed

1.1%

of sites scanned set it (450 of 41,162)

under an hour

median observed lifetime

TagPipes scanned 41,162 public websites between August 11, 2026 and September 13, 2026, loading up to three pages per site in a real browser as a first-time visitor. __stripe_sid was present on 450 of them.

It was set as a first-party cookie on 430 sites and as a third-party cookie on 20. A site can count in both. Where it was stored as a persistent cookie, the median lifetime we recorded was under an hour.

Often found alongside

Percentage of sites with __stripe_sid where the other cookie was also present.

Technologies detected on the same sites

  • Stripe on 100% of them (1.5% of all sites scanned)
  • Google Fonts on 67% of them (78% of all sites scanned)
  • Google Analytics on 62% of them (55% of all sites scanned)
  • reCAPTCHA on 37% of them (32% of all sites scanned)
  • Squarespace on 33% of them (23% of all sites scanned)

Aggregate figures across all sites scanned. Websites of TagPipes customers are excluded, no individual site is named, and cookie values are never read or stored. Snapshot dated September 13, 2026.

How to check for __stripe_sid on a website

  1. Open the site in Chrome, then open DevTools (F12, or Cmd+Option+I on a Mac).
  2. Go to the Application tab and expand Cookies in the left panel.
  3. Select each domain listed there and look for __stripe_sid. The Expires column shows when it will be deleted.
  4. If it is not there, reload the page. Many cookies are only set after a tag has loaded, and some only after a visitor has made a consent choice.

Other Stripe cookies

Sources

Purpose, duration and value format checked against the vendor documentation above on . The figures under What TagPipes observed are TagPipes scan data from September 13, 2026, not values documented by the vendor. Vendors change their cookies, and sites can configure their own names and lifetimes. Browse all cookies.

Know every cookie your own site sets

TagPipes Pulse identifies the cookies dropped on your site and flags unclassified or miscategorized ones. Shield builds your cookie declaration from a real scan rather than a questionnaire.

See Pulse See Shield

TagPipes monitors, configures and reports. It does not determine legal compliance and does not provide legal advice. Output is informational and reflects observed state at the time of observation. Rawsoft's expertise is technology, not law; please confirm any regulatory interpretation with your own counsel.