Cookies, LocalStorage and SessionStorage can all remember state, but they behave differently.
- Cookies can be sent automatically with matching HTTP requests and are commonly used for sessions.
- LocalStorage is read explicitly by JavaScript and normally persists until it is cleared.
- SessionStorage is scoped to a browsing session and normally disappears with the tab.
Security differences matter
JavaScript can read LocalStorage, so storing passwords or long-lived high-value secrets there is a poor design. Session cookies can instead use controls such as HttpOnly, Secure and SameSite to reduce specific risks.
Why clearing site data logs you out
A browser cleanup may remove session cookies, local storage, IndexedDB and service-worker state, not just cached images. The site then loses the information that linked your browser to an authenticated session.
The mobile debugging guide shows where to inspect these stores before wiping them.