What is the difference between a cookie and localStorage?

The answer

A cookie is sent to the server automatically with matching requests, while localStorage never leaves the browser unless your own code sends its contents. Cookies can carry flags such as HttpOnly and Secure, so scripts cannot read an HttpOnly cookie. LocalStorage is readable by any script on the page, which makes it a weaker home for session tokens. MDN notes that modern storage APIs are recommended for general client-side storage because cookies are sent with every request and can hurt performance.