Session Cookies vs JWT

Subtitle: Stateful memory vs stateless proof

Left column - Session Cookies:

Server stores the session record Cookie holds only an opaque ID Revoke instantly: delete the row Needs a shared store (Redis) to scale HttpOnly + Secure + SameSite flags

Right column - JWT:

Server stores nothing at all Signed claims travel inside the token Cannot revoke until it expires Scales across services, no lookup A leaked token stays valid till exp

Simple difference:

Session = the server remembers you JWT = the token vouches for you

Use it when - Session Cookies: browser apps, instant logout, one trust domain Use it when - JWT: service-to-service, short-lived access, many APIs

Sticky note - Common beginner mistake:

Storing a JWT in localStorage. Any XSS steals it; use an HttpOnly cookie and keep expiry short.