All questions
Q & A Security · September 11, 2026

Should I store a JWT in localStorage or a cookie?

For browser applications, prefer a Secure, HttpOnly, SameSite=Strict cookie. localStorage is accessible to any JavaScript on the page, so a single XSS bug leaks every user’s token. A properly-scoped cookie is protected from JavaScript reads. Downsides: cookies require CSRF protection (SameSite handles most cases) and are attached to every request to the origin.

Read the full guide
What Is a JWT? JSON Web Token Structure, Signing, and Security Explained
JWT (JSON Web Token) is the dominant format for API authentication, OAuth access tokens, and stateless session management. Three base64-encoded segments carry the header, claims, and signature — anyone can read them, but only the key holder can produce a valid token.
Related questions
Are UUIDs guaranteed to be unique? Can I revoke a JWT before it expires? Can I use UUID as a primary key? How do I verify a JWT signature without the secret? How much larger does Base64 make my payload?