Nextcloud only stores cookies that are necessary for it to function. All
cookies are set by your Nextcloud server directly — no third-party cookies
are involved.
Under GDPR, only cookies that store or transmit personal data require a legal
basis or consent. Of the cookies listed below, only the remember-me cookies
contain personal data (the username). All other cookies contain randomly
generated tokens with no inherent personal information.
Cookies stored by Nextcloud
Type
Name
Purpose
Personal data
Lifetime
Session cookie
<instance_id>
Carries a random PHP session ID used to identify the user's session
on the server.
No
Until browser is closed.
Session cookie
oc_sessionPassphrase
Carries a random token used to decrypt the session data stored on the
server.
No
Until browser is closed.
Same-site cookie
__Host-nc_sameSiteCookiestrict
Used to detect whether a request originates from the same site
(SameSite=Strict). Helps prevent CSRF attacks. Contains no user
information.
No
Expires 2100-12-31 (effectively permanent).
Same-site cookie
__Host-nc_sameSiteCookielax
Used to detect cross-site navigation requests
(SameSite=Lax). Helps prevent CSRF attacks. Contains no user
information.
No
Expires 2100-12-31 (effectively permanent).
Remember-me cookie
nc_username
Stores the user's login name to enable persistent login across browser
sessions.
Yes — contains the username.
Defaults to 15 days. Configurable via remember_login_cookie_lifetime.
Remember-me cookie
nc_token
A random token paired with nc_username to authenticate the
persistent login without storing the password.
No
Same as nc_username.
Remember-me cookie
nc_session_id
The original session ID, retained to allow session continuity when the
remember-me token is used.
No
Same as nc_username.
Download helper
ocDownloadStarted
A short-lived random token set when a file download begins, used to
signal the browser that the download has started (e.g. to hide a
loading indicator).
No
20 seconds.
Remember-me cookies
The remember-me cookies (nc_username, nc_token, nc_session_id) are
only set when the user explicitly selects Remember me at login. They are
cleared immediately when the user logs out.
Because nc_username contains the user's login name, it is personal data
under GDPR. The legal basis for storing it is typically legitimate interest
or contract performance (enabling the service the user has requested),
provided the user has been informed of this in your privacy policy.
The lifetime defaults to 15 days and can be shortened in config/config.php: