The Application tab
The Application tab contains the data a page retains between reloads: authentication state, a dismissed cookie banner, a selected language. None of it is stored on the server; it is held in the browser.
Cookies
Named values that the browser attaches to every request to the site; this is how the server identifies a session as the visitor moves between pages. Each cookie has an expiry date and the flags HttpOnly (not readable by scripts) and Secure (transmitted over HTTPS only).
In the Cookies table, the Expires / Max-Age column shows the expiry date or lifetime set by the server: compare it with the current date to check a required lifetime. A session cookie has no expiry date and is removed when the browser closes.
A cookie consent example: after “Accept” is pressed the site stores a cookie, cookie_consent=accepted for instance. The next time the page opens, the site reads that value and does not show the banner again. The banner returns if the cookie expires or the user clears their cookies.
Local storage and session storage
Both hold key–value pairs, both are readable by scripts, and neither is sent to the server automatically — the page has to include the value in a request explicitly. They differ in lifetime: local storage persists after the browser is closed, session storage is cleared when the tab is closed.
The cache
The browser retains copies of previously downloaded files, so a normal reload can return an outdated script or stylesheet. A hard reload — ctrl shift r / cmd shift r — requests the files from the server again. This explains cases where a fix appears not to be deployed: before reporting one, perform a hard reload and check the Network tab for from disk cache.
Use in testing
Clearing storage returns the browser to the state of a first-time visitor: Application → Clear site data, or a private window. This is the procedure for anything that should occur only once — a cookie banner, an onboarding tour, a “new” badge. For reports of unexpected sign-outs, the cookie expiry date in this tab is the first thing to check.
At the interview
This group is about the data that stays in the browser between reloads, and the cases where it gets in the way of a check. Try answering before opening the answer.
juniorentry-level knowledge
1. How does a cookie differ from local storage and session storage?
The browser attaches a cookie to every request to the site by itself, which is how the server recognises the session. Local storage and session storage are never sent automatically: the page has to include the value in a request explicitly. Between the two storages the difference is lifetime — local storage survives the browser closing, session storage is cleared when the tab closes.
2. How do you check that the cookie banner appears on a first visit to the page?
Put the browser back into the state of a new visitor: Application → Clear site data, or open the page in a private window. On that first opening the banner has to appear.
The rest of the check is that it appears exactly once: after “Accept” the site stores a cookie — cookie_consent=accepted, for instance, visible in the Cookies table — and on the next opening it reads that value and leaves the banner out. Clear the site data again and the banner has to come back.
3. The fix is deployed but the page still behaves the old way. What do you check before reporting?
The cache. An ordinary reload can return the old script or stylesheet, so what is needed is a hard reload — ctrl shift r / cmd shift r — and a look at Network: if the Size column says from disk cache, the file came from the cache rather than from the server.
middlea more advanced level
4. What do the HttpOnly and Secure flags on a cookie mean?
HttpOnly means the cookie is not readable by scripts on the page, which protects the value from being taken through JavaScript. Secure means it is only transmitted over HTTPS. Both flags are visible in the Cookies table of the Application tab.
5. Users are being signed out earlier than they should be. What do you look at in Application?
The Expires / Max-Age column of the session cookie: it holds the expiry date or lifetime the server set, and it is compared against the required one. A cookie with no expiry is a session cookie and is removed when the browser closes.
Questions on the other topics are collected on the QA interview questions on DevTools page.