Privacy policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
| Cookie | Category | Purpose |
|---|---|---|
app_manifest_token | Functional | This cookie is used during the App Manifest flow to maintain the state of the flow during the redirect to fetch a user session. |
color_mode | Functional | This cookie is used to indicate the user selected theme preference. |
_device_id | Functional | This cookie is used to track recognized devices for security purposes. |
dotcom_user | Functional | This cookie is used to signal to us that the user is already logged in. |
enterprise_trial_redirect_to | Functional | This cookie is used to complete a redirect for trial users |
fileTreeExpanded | Functional | Used to indicate whether the file tree on the code view was last expanded or collapsed |
_gh_ent | Functional | This cookie is used for temporary application and framework state between pages like what step the customer is on in a multiple step form. |
_gh_sess | Functional | _gh_sess This cookie is used for temporary application and framework state between pages like what step the user is on in a multiple step form. |
ghcc | Functional | This cookie validates user's choice about cookies |
gist_oauth_csrf | Strictly necessary | This cookie is set by Gist to ensure the user that started the oauth flow is the same user that completes it. |
gist_user_session | Functional | This cookie is used by Gist when running on a separate host. |
has_recent_activity | Functional | This cookie is used to prevent showing the security interstitial to users that have visited the app recently. |
__Host-gist_user_session_same_site | Functional | This cookie is set to ensure that browsers that support SameSite cookies can check to see if a request originates from GitHub. |
__Host-user_session_same_site | Functional | This cookie is set to ensure that browsers that support SameSite cookies can check to see if a request originates from GitHub. |
marketplace_repository_ids | Functional | This cookie is used for the marketplace installation flow. |
marketplace_suggested_target_id | Functional | This cookie is used for the marketplace installation flow. |
_octo | Analytics | This cookie is used for session management including caching of dynamic content, conditional feature access, support request metadata, and first party analytics |
org_transform_notice | Functional | This cookie is used to provide notice during organization transforms. |
private_mode_user_session | Functional | This cookie is used for Enterprise authentication requests. |
saml_csrf_token | Strictly necessary | This cookie is set by SAML auth path method to associate a token with the client. |
saml_return_to | Functional | This cookie is set by the SAML auth path method to maintain state during the SAML authentication loop. |
saml_return_to_legacy | Functional | This cookie is set by the SAML auth path method to maintain state during the SAML authentication loop. |
show_cookie_banner | Functional | Set based on the client’s region and used to determine if a cookie consent banner should be shown |
tz | Functional | This cookie allows us to customize timestamps to your time zone. |
user_session | Functional | This cookie is used to log you in. |
Running GitHub on your site? A free Conzent scan shows which of these cookies are set before consent, and the banner blocks them until the visitor agrees.
Last updated 2026-09-27.