# Where to store JWT?

**URL:** <https://community.auth0.com/t/where-to-store-jwt/15949>\
**Category:** JWT.io\
**Created:** [September 26, 2018, 2:01pm UTC](https://community.auth0.com/t/where-to-store-jwt/15949 "2018-09-26T14:01:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vivekgangotri](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@vivekgangotri](https://community.auth0.com/u/vivekgangotri)\
**Post date:** [September 26, 2018, 2:01pm UTC](https://community.auth0.com/t/where-to-store-jwt/15949/1 "2018-09-26T14:01:37Z")

</div>

where to store JWT ?

I researched for JWT storage, some says localstorage / cookie/ etc…  
So which one will be better in terms of protection

---

<div class="post-metadata">

**Author:** ![luke.oliff](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/luke.oliff/32/8938_2.png) [@luke.oliff](https://community.auth0.com/u/luke.oliff)\
**Post date:** [September 26, 2018, 3:46pm UTC](https://community.auth0.com/t/where-to-store-jwt/15949/2 "2018-09-26T15:46:55Z")

</div>

If you can, you should use a session cookie between the SPA and backend.

In the context of an application that runs in the client (React, Angular, Vue, etc, etc) where you _must_ keep an access token in the client, storing them in memory is what I would recommend. Using scope limited, _not_ global, variables.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [July 26, 2019, 11:32am UTC](https://community.auth0.com/t/where-to-store-jwt/15949/3 "2019-07-26T11:32:22Z")

</div>