Vinted cookie: how it works and why it matters in 2026

What is a Vinted cookie

A cookie is a small file stored by your browser after login. It contains a session identifier that proves to Vinted that you're logged in.

The Vinted session cookie (name: _vinted_fr_session and variants) is what keeps you logged in when you close the tab and come back later.

How Vinted authenticates your actions

Every click on Vinted (relist, send message, create listing) triggers an API call. Vinted reads your session cookie + a CSRF (Cross-Site Request Forgery) token on every call to verify it's really you.

How extensions use your cookie

A local Chrome extension (Redrip, Vintup, Dotb) reads the Vinted cookie already present in your browser and makes the same API calls you'd make manually. Your Vinted password is never requested, neither is your username.

That's the major advantage of extensions vs cloud SaaS (Clemz, Bleam, Veezsto) which ask for your Vinted credentials to automate from their servers.

Cookie security

– Local storage: only your browser has the cookie
– HttpOnly: not accessible by external JavaScript (anti-XSS)
– Secure: only transmitted over HTTPS
– SameSite Lax: not sent on malicious cross-site requests

Lifespan

Vinted session: ~30 days without logout. Renewed at each login. If you clear your cookies, you have to log back in.

Third-party Vinted cookies

Vinted also uses tracking cookies (Google Analytics, Meta Pixel) for targeted advertising. You can disable them in Vinted's privacy settings.

Cookie-related risks

Cookie theft

If someone accesses your browser (physically or via malware), they can copy your session cookie and import it into their browser = access to your account without a password.

Protection

– Lock your computer when you step away
– Antivirus up to date
– No unverified shady extensions (Chrome Web Store only)
– Log out of public Vinted sessions

Why local extension > cloud SaaS

Extension: cookie stays in your browser, never shared. SaaS: your credentials transit through their servers = compromise risk.