From a technical point of view, the content of the cookie value is opaque and can be anything that the server requires, even binary data, if the received HTTP headers comply with the rules of the HTTP specifications. By convention, most servers encode non-ASCII data, usually with URL encoding (non-ASCII byte is represented as "% XX", where XX is the hexadecimal value of the byte).
source share