diff --git a/httpd/httpd.c b/httpd/httpd.c
index fb9c678f..c01b0650 100644
--- a/httpd/httpd.c
+++ b/httpd/httpd.c
@@ -668,6 +668,8 @@ static void run_login_body(__xdata uint8_t *body)
 				      "Set-Cookie: session=");
 		for (uint8_t i = 0; i < SESSION_ID_LENGTH; i++)
 			outbuf[slen++] = session_id[i];
+		slen += strtox(outbuf + slen, "; Max-Age=");
+		itoa16_html(session_timeout);
 		slen += strtox(outbuf + slen, "; SameSite=Strict\r\n\r\n");
 	} else {
 		dbg_string("Password invalid!\n");
diff --git a/httpd/page_impl.c b/httpd/page_impl.c
index 6011f80a..6000fd26 100644
--- a/httpd/page_impl.c
+++ b/httpd/page_impl.c
@@ -100,12 +100,14 @@ void itoa_html(uint8_t v)
 	char_to_html('0' + (v % 10));
 }
 
-void itoa16_html(uint16_t v) /* sufficient for VLAN IDs (max 4094) */
+void itoa16_html(uint16_t v) /* up to five digits (65535) */
 {
 	uint8_t print_zeros = 0;
 	uint8_t d;
-	d = v / 1000;
+	d = v / 10000;
 	if (d) { char_to_html('0' + d); print_zeros = 1; }
+	d = (v / 1000) % 10;
+	if (d || print_zeros) { char_to_html('0' + d); print_zeros = 1; }
 	d = (v / 100) % 10;
 	if (d || print_zeros) { char_to_html('0' + d); print_zeros = 1; }
 	d = (v / 10) % 10;
diff --git a/httpd/page_impl.h b/httpd/page_impl.h
index cad4cd6f..22a9f259 100644
--- a/httpd/page_impl.h
+++ b/httpd/page_impl.h
@@ -5,6 +5,8 @@
 
 extern __code uint8_t * __code HTTP_RESPONCE_TXT;
 
+void itoa16_html(uint16_t v);
+
 bool send_counters(uint8_t phys_port);
 void send_status(void);
 void send_vlan(uint16_t vlan);