<p>A macaroon consists of three parts:</p>
<ol>
<li>The header: Identifies the macaroon and contains three fields.
<ul>
<li>The <code>version</code>: 1 byte, always set to <code>0x02</code> in <code>lnd</code></li>
<li>The <code>location</code>: variable length string, always set to <code>&quot;lnd&quot;</code> in <code>lnd</code></li>
<li>The <code>identifier</code>: variable length binary data, contains <code>protobuf</code> serialized data in <code>lnd</code> containing the <strong>permissions</strong> of the macaroon. More on that later.</li>
</ul>
</li>
<li>The <code>caveats</code>: Restricts the capabilities of the macaroon. This is a variable length list of strings. <code>lnd</code> currently only implements two possible restrictions, the <code>time-before</code> and the <code>ipaddr</code> restriction.
<ul>
<li>Example with maximum characters:
<pre><code>[&quot;time-before 2006-01-02T15:04:05.999999999Z07:00&quot;, &quot;ipaddr 255.255.255.255&quot;]
</code></pre>
Which is roughly 70 bytes plus some encoding overhead.</li>
</ul>
</li>
<li>The <code>signature</code>: An <code>HMAC-SHA256</code> hash, so 32 bytes plus encoding overhead.</li>
</ol>
<h1>The permissions</h1>
<p>As mentioned above, the macaroon identifier contains a list of permissions. Currently this just contains a <code>protobuf</code> serialized list of <code>{Entity string, Action string}</code> pairs that correspond to <a href="https://github.com/lightningnetwork/lnd/blob/56af0e15224ffd65d2fe3ebf7e595fa3a6b07d31/rpcserver.go#L201" rel="nofollow noreferrer">permission sets in <code>lnd</code></a>. For example, the pair <code>{Entity: &quot;info&quot;, Action: &quot;read&quot;}</code> would give a user read-only access to informational calls.</p>
<p>These permissions make it a bit tricky to estimate the maximum size of a macaroon in <code>lnd</code>. At the moment, the maximum number of distinct entity/action pairs that exists is 17, which is given to the automatically created <code>admin.macaroon</code>. That admin macaroon currently is around 280 bytes in size.</p>
<p>But soon, you will be able to customize the permissions of a macaroon even further by <a href="https://github.com/lightningnetwork/lnd/pull/4463" rel="nofollow noreferrer">specifying individual URIs that are allowed to be accessed</a>. A user could could then, for example, add a permission pair of <code>{Entity: &quot;uri&quot;, Action: &quot;/lnrpc.Lightning/ExportAllChannelBackups&quot;}</code> to a custom macaroon.</p>
<p>Just for fun, I went ahead and created a <a href="https://gist.github.com/guggero/c1ffcc309ef0ad8079196e3ba6d02b50" rel="nofollow noreferrer">maximum-sized macaroon with all currently available URIs</a> which turned out to be <strong>4041</strong> bytes in size.</p>
<p>From that, I would summarize that limiting user input when uploading a macaroon to 4096 or 5120 bytes should cover almost all cases of custom macaroons.</p>

CC BY-SA 4.0
2020-07-26T11:54:13.520Z
2020-07-26T11:54:13.520Z
guggero
<p>In an LND node, what is the max size, in bytes, of a macaroon. If there is no explicit max length, what can you reasonably expect to be the size of your macaroon?</p>

<lightning-network><lightning-network-daemon><macaroon>
what is the macaroon max length
arshbot
# what is the macaroon max length

(Asked by: username_0 on 2020-06-04)

In an LND node, what is the max size, in bytes, of a macaroon. If there is no explicit max length, what can you reasonably expect to be the size of your macaroon?

**Tags:** lightning-network, lightning-network-daemon, macaroon


---

## 1 answers

### Answer by username_1 on 2020-07-26. Score: 1 | Accepted answer

A macaroon consists of three parts:

1. The header: Identifies the macaroon and contains three fields.
   * The `version`: 1 byte, always set to `0x02` in `lnd`
   * The `location`: variable length string, always set to `"lnd"` in `lnd`
   * The `identifier`: variable length binary data, contains `protobuf` serialized data in `lnd` containing the **permissions** of the macaroon. More on that later.
2. The `caveats`: Restricts the capabilities of the macaroon. This is a variable length list of strings. `lnd` currently only implements two possible restrictions, the `time-before` and the `ipaddr` restriction.
   * Example with maximum characters:

     ```
     ["time-before 2006-01-02T15:04:05.999999999Z07:00", "ipaddr 255.255.255.255"]

     ```

     Which is roughly 70 bytes plus some encoding overhead.
3. The `signature`: An `HMAC-SHA256` hash, so 32 bytes plus encoding overhead.

# The permissions

As mentioned above, the macaroon identifier contains a list of permissions. Currently this just contains a `protobuf` serialized list of `{Entity string, Action string}` pairs that correspond to [permission sets in `lnd`](https://github.com/lightningnetwork/lnd/blob/56af0e15224ffd65d2fe3ebf7e595fa3a6b07d31/rpcserver.go#L201). For example, the pair `{Entity: "info", Action: "read"}` would give a user read-only access to informational calls.

These permissions make it a bit tricky to estimate the maximum size of a macaroon in `lnd`. At the moment, the maximum number of distinct entity/action pairs that exists is 17, which is given to the automatically created `admin.macaroon`. That admin macaroon currently is around 280 bytes in size.

But soon, you will be able to customize the permissions of a macaroon even further by [specifying individual URIs that are allowed to be accessed](https://github.com/lightningnetwork/lnd/pull/4463). A user could could then, for example, add a permission pair of `{Entity: "uri", Action: "/lnrpc.Lightning/ExportAllChannelBackups"}` to a custom macaroon.

Just for fun, I went ahead and created a [maximum-sized macaroon with all currently available URIs](https://gist.github.com/username_1/c1ffcc309ef0ad8079196e3ba6d02b50) which turned out to be **4041** bytes in size.

From that, I would summarize that limiting user input when uploading a macaroon to 4096 or 5120 bytes should cover almost all cases of custom macaroons.


---

