The "official" maximum size is 4KB, but I would prefer to keep it well under that: no more than a few hundred bytes, tops.
The reason is that cookies are transmitted from the client to the server with every single request - even when requesting images, css and js files (if they reside on the same host something you should avoid in general, but for small sites may not be worth the bother). That means that you'll be requiring the client to transmit 4KB for every request - remembering also that most consumer broadband has much slower upload speed than download speed.
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
