JSON.stringify / parse serialize objects. localStorage persists key-value strings in the browser (not for secrets).
localStorage limits
~5MB per origin, synchronous API—blocks main thread on large data. Never store tokens without understanding XSS risk.
sessionStorage
Same API but cleared when tab closes.
Important interview questions and answers
- Q: JSON dates?
A: Serialized as strings—revive manually if needed. - Q: localStorage secure?
A: No—any script on page can read; HttpOnly cookies for session tokens.
Self-check
- Why not store JWT in localStorage?
- What does JSON.stringify skip?
Pitfall: Never store refresh tokens in localStorage on public sites.
Interview prep
- JWT in localStorage?
Risky with XSS—prefer HttpOnly cookies for sessions.