Security What Never to Store in Storage

localStorage and sessionStorage save data unencrypted on disk under the user profile. Any process with file-system access — including malware, backup tools, or another logged-in user — can read every value you stored without going through the browser.

All scripts running on the origin share the same Storage. A successful XSS attack, a compromised third-party SDK, or a malicious browser extension can call localStorage.getItem and exfiltrate every stored value. There is no per-script isolation.