Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHTML5 Web Storage is the browser’s built-in Web Storage API: two simple, origin-scoped key/value stores named localStorage and sessionStorage. Values are strings, access is synchronous, and the feature is best for small conveniences such as preferences, draft text, or a temporary workflow—not for passwords, large datasets, or durable application records.
What HTML5 Web Storage provides
The term “HTML5 Web Storage” usually means the Web Storage interfaces defined in the HTML Living Standard. Each store maps string keys to string values and is exposed through the window object. The API consists primarily of setItem(), getItem(), removeItem(), clear(), and the length property.
Storage belongs to a document’s origin—its scheme, host, and port. Code running on a different origin cannot read the same store. Browsers can apply additional partitioning policies, particularly in privacy-focused or embedded contexts.
localStorage versus sessionStorage
| Characteristic | localStorage |
sessionStorage |
|---|---|---|
| Sharing scope | Pages with the same origin normally share one store. | Same-origin pages in the same top-level tab or window share a page-session store; another tab gets a separate store. |
| Lifetime | Normally remains after navigation, browser restart, and reopening the site. | Lasts for the tab or window’s page session and is cleared when that session ends. |
| Typical uses | Theme choice, language preference, dismissed notices, or a small user setting. | Multi-step form state, a one-tab workflow, or temporary navigation data. |
| Automatic synchronization | Changes can be observed by other same-origin documents through the browser’s storage-event mechanism. | Changes are confined to the relevant page session. |
“Persistent” does not mean permanent. Users can clear site data, browser policies can block access, and browsers may evict best-effort data. Private-browsing sessions generally discard their storage when the private session ends, and some implementations expose little or no usable space.
#1 Best Overall
How to read and write values
Basic operations
// Save a string
localStorage.setItem("theme", "dark");
// Read it; getItem returns null when the key is absent
const theme = localStorage.getItem("theme");
// Delete one key
localStorage.removeItem("theme");
// Delete every key in this origin's local store
localStorage.clear();
// The equivalent temporary store
sessionStorage.setItem("checkoutStep", "shipping");Use the methods rather than treating the storage object like an ordinary JavaScript object. Property-style access can collide with built-in names and does not express the API’s missing-key behavior clearly.
Store objects and arrays with JSON
Storage does not preserve JavaScript objects, numbers, booleans, dates, or arrays as their original types. Serialize structured data explicitly and handle malformed or outdated data when parsing.
const settings = { theme: "dark", compact: true };
localStorage.setItem("settings", JSON.stringify(settings));
let savedSettings = null;
try {
const raw = localStorage.getItem("settings");
savedSettings = raw === null ? null : JSON.parse(raw);
} catch (error) {
// The stored value may be corrupt or storage access may be blocked.
savedSettings = null;
}JSON is convenient but adds serialization cost and does not retain types such as functions or class instances. Keep records small and version them if the application’s format may change.
Capacity and quota errors
Current MDN guidance describes Web Storage as limited to 10 MiB total per origin, with up to 5 MiB for local storage and 5 MiB for session storage. These are guidance figures, not a universal guarantee: browser, device, profile, private mode, and policy can change the usable amount. A write that exceeds available space can throw QuotaExceededError.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
| Situation | What your code should do |
|---|---|
| Normal write | Call setItem() inside error handling. |
| Quota exhausted | Remove expendable entries, reduce the payload, or fall back to an in-memory/default value. |
| Storage blocked or unavailable | Continue without persistence and tell the user only if the feature depends on saving. |
function trySave(key, value) {
try {
localStorage.setItem(key, value);
return true;
} catch (error) {
if (error instanceof DOMException &&
(error.name === "QuotaExceededError" || error.name === "NS_ERROR_DOM_QUOTA_REACHED")) {
// Quota policy: prune nonessential data or use a fallback.
}
return false;
}
}Do not infer available capacity by filling storage in production. Such tests can be disruptive and still cannot predict later eviction or policy changes.
Availability, privacy, and security
Access can fail
Reading window.localStorage or writing to it can fail when a browser setting, privacy extension, enterprise policy, sandboxed iframe, or private-browsing implementation denies storage. The behavior of file: URLs is not consistently specified across browsers. Feature code should test access and handle exceptions instead of assuming that the property always works.
Do not use it as a secret vault
Any script that executes in your origin can usually read the same Web Storage. A cross-site-scripting vulnerability can therefore expose tokens or personal data stored there. Web Storage has no equivalent to an HttpOnly cookie flag. Avoid placing passwords, long-lived authentication secrets, payment data, or other sensitive information in it; use an appropriate server-side session design and narrowly scoped credentials instead.
Clearing cookies may not clear storage
The HTML Standard warns that local storage and cookies can act as redundant tracking state. A user who deletes cookies may still have an identifier in local storage. Applications should provide a genuine “delete my data” path that removes their own storage entries and should respect browser privacy controls.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Best Value
When Web Storage is the wrong tool
| Need | Better fit | Why |
|---|---|---|
| Small scalar preferences or temporary state | Web Storage | Simple key/value API with minimal setup. |
| Many records, indexes, transactions, or offline application data | IndexedDB | Asynchronous structured storage designed for substantially larger datasets and queries. |
| Caching request and response objects | Cache API | Models HTTP resources rather than string values. |
| Large files or origin-private file workflows | Origin Private File System | Designed for file-like data and application-managed files. |
Browser-managed storage is generally best-effort unless the site obtains persistent-storage permission. Even then, user deletion, profile removal, quota policy, or device management can remove data. Important information should have a server or export-based recovery path.
A practical implementation checklist
- Choose the lifetime first: use
sessionStoragefor one tab’s workflow andlocalStorageonly when reopening the site should normally retain the value. - Keep the payload small, string-based, and explicitly serialized.
- Namespace keys, for example
app:v2:settings, so unrelated features do not collide. - Wrap both access and writes in
try...catch; provide defaults when storage is blocked or full. - Validate and migrate parsed data rather than trusting old JSON indefinitely.
- Never store secrets that an injected script must not be able to read.
- Offer a clear reset or delete-data control for user-created entries.
- Move to IndexedDB, Cache API, or the Origin Private File System when records, files, queries, or durability requirements outgrow Web Storage.
Common misconceptions
“localStorage is permanent”
It normally survives browser restarts, but it remains subject to user deletion, browser policy, private-mode rules, and eviction.
“sessionStorage is shared by every tab”
Each top-level browsing context has its own page-session store. Two tabs at the same origin should not be treated as one shared session.
“Web Storage is a database”
It is a synchronous string map. There are no built-in indexes, transactions, relational queries, or binary-file semantics; those needs point to other storage APIs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
