For browser applications, prefer a Secure, HttpOnly, SameSite=Strict (or Lax) cookie. localStorage is accessible to any JavaScript on the page — one XSS vulnerability leaks every user’s token. A properly-scoped cookie is invisible to JavaScript and immune to XSS-based extraction. Downsides of cookies: (1) attached to every request to the origin (bandwidth on API-heavy apps), (2) require CSRF protection (SameSite handles most cases). For mobile apps or CLI tools, use OS keychain / secure storage — neither localStorage nor cookies apply.
All questions
Should I store a JWT in localStorage or a cookie?
Read the full guide
What Is a JWT?
JWT (JSON Web Token) is the dominant format for API authentication, OAuth access tokens, and stateless session management. Three base64-encoded segments carry the header, claims, and signature — anyone can read them, but only the key holder can produce a valid token.