Cookies have a special storage place in the browser and limited storage space. This limitation makes it so that usual practice for cookies is to store only a UU

Cookies have a special storage place in the browser and limited storage space. This limitation makes it so that usual practice for cookies is to store only a UUID-style identifier client-side and the rest of the data for the session server-side, necessitating a database round-trip before you can even know who's hitting your server. JWT allows you to use the browser as the fatter client that it has been slowly growing into. Because JWT is JSON, it can store anything, and you're only limited by how large you want to make your web requests. (they're sent with each request) At the end of the day, they're both ways to build state into a stateless protocol.