Should I use JWT or sessions for authentication?

For most server-rendered apps, sessions are simpler and safer. Use JWT when you need stateless authentication across multiple services, when you're building a mobile app API, or when you genuinely can't store server-side session state. JWT in localStorage is a security antipattern — if you use JWT, store it in an httpOnly cookie.

Is JWT in localStorage safe?

No. Any JavaScript running on your page can read localStorage, including third-party scripts and any XSS attack. A single XSS vulnerability lets an attacker steal every user's token. Store JWTs in httpOnly cookies that JavaScript cannot read.

What is OAuth and when should I use it?

OAuth lets users log in with Google, GitHub, Apple, etc. instead of creating a new password. Use it when you don't need custom password storage and want verified emails for free. Most consumer apps should offer at least Google and Apple OAuth alongside email/password.

What is refresh token rotation?

Your access token is short-lived (minutes). Your refresh token is long-lived (days). Every time the client uses the refresh token to get a new access token, the server issues a new refresh token and invalidates the old one. This limits damage if a refresh token leaks.

August 22, 2026·3 min read

JWT vs Sessions vs OAuth in 2026 — Pick the Right One

Auth advice on the internet is mostly cargo cult. "Use JWT" was the 2018 answer. The 2026 answer is "it depends, and probably not localStorage JWT." Here's the real framework.

AuthenticationJWTSessionsBackendSecurity

Auth advice on the internet is mostly cargo cult. "Use JWT" was the 2018 answer. "JWT is bad, use sessions" was the 2022 answer. The 2026 answer is: it depends, and probably not localStorage JWT.

Here's the actual decision framework, from someone who has shipped all three patterns in production.

The three patterns

1. Sessions (server-side state)

← Back to blog