JWT tokens, and any session tokens are used for authentication, like a password. The issue is that people don't want to entire a password every single time they

JWT tokens, and any session tokens are used for authentication, like a password. The issue is that people don't want to entire a password every single time they want to send a request that requires authentication. Imagine google/facebook/etc. prompting you for a password every time you click a link. That's what it would be like if browsers couldn't store session tokens. Typically the matching hostname can view local data/cookies though (along with any extensions you have that have access to it - which is most of them). That's why you shouldn't ever copy/paste stuff into the console of a website, it lets people extract your session.