Comparison
CookievssessionStorage
Cookie
the value went out with every single request to that domain, whether it was needed or not.
A small piece of data the browser stores and attaches automatically to matching requests. That automatic attachment is the entire difference from other storage: it is what makes cookies work for sessions and what makes them cost bytes on every request. Size limits are small, the attributes controlling scope and security are numerous, and the ones that matter are `HttpOnly`, `Secure` and `SameSite`.
Full entry →sessionStorage
the value survived a refresh and vanished when the tab was closed, and the other tab never saw it.
The same API as `localStorage` with a different lifetime: scoped to one tab and cleared when it closes. That per-tab isolation is the point — it is right for a multi-step flow that should not leak between tabs, and wrong for anything the user expects to persist. A duplicated tab copies the contents once and then the two diverge, which surprises people.
Full entry →