JWT vs Session Cookies

“JWT vs cookies” is often the wrong framing. Cookies are a transport. JWT and server sessions are credential models.

Quick comparison

Concern	Session cookie (server session)	JWT (bearer / cookie)
Server state	Session store (memory/Redis/DB)	Often stateless until refresh/denylist
Revocation	Delete session → instant	Needs short TTL or denylist
CSRF	Risk if cookie auth on browser	Cookie-stored JWT shares CSRF; header bearer less so
Mobile / API	Possible with cookies; APIs often prefer bearer	Common for APIs and SPAs
Size	Session id is small	JWT can get large with claims

Prefer session cookies when

• Classic server-rendered sites with a session store you already run
• You need instant logout / ban without extra infrastructure
• Same-site browser apps where CSRF protections are straightforward

Prefer JWTs when

• Multiple services must validate a token without shared session DB
• Mobile or third-party clients send Authorization: Bearer
• Short-lived access tokens + rotating refresh is acceptable

Practical hybrid

Many production apps use:

1. Short-lived access JWT
2. Refresh token in httpOnly cookie or secure store
3. Server-side refresh rotation / reuse detection

Debug tooling

Paste a token into JWT Decoder to inspect exp, iat, and claims locally — nothing is uploaded. Pair with JWT Generator for local HS* test tokens only.

Hub: Dev Auth Ops.