Definition
Cookies and sessions are two ways a website remembers who you are and keeps track of your state. A cookie is a small note stored right on your computer (in your browser), while a session keeps your information in a locked vault on the server and hands you only a claim ticket.
The Hand Stamp and the VIP Ledger: Why Do Websites Need Memory?
HTTP, the basic language of the web, works like a person with amnesia. You just clicked the login button, but the moment you go to the next page, the server wonders, "Now, who were you again?" You can't keep typing your username and password on every page.
So websites need a way to mark who you are. One way is to leave a small note in your browser. That technology is the cookie. It works like the hand stamp you show when you re-enter a theme park. Each time, your browser holds up the note to the web server and says, "Hey, I'm the person who logged in a minute ago."
But writing a password or personal details directly on your own computer is risky, because someone could peek at it. So for sensitive information, the server keeps its own secret ledger and manages it there. This approach is called a session.
How Do Cookies and Sessions Split the Job?
A cookie is saved as a file right on your device (your web browser). It powers handy features like "Don't show this popup again today" or the list of items in your shopping cart. It can also hold the login claim ticket (the session ID) we'll talk about below. Since it doesn't use the server's storage, it has the advantage of taking load off the server.
A session, on the other hand, keeps the real information (your name, membership level, payment status) only inside the server's memory or database. Your browser gets just a claim ticket that says, "You're customer number 77." That ticket is called a session ID.
When you come back with your ticket, the server opens drawer number 77 in its ledger and checks your status. This way, sensitive personal information never sits in your browser. It stays on the server, which makes it safer. One catch: if someone steals your ticket (the session ID), they can pretend to be you. So sites protect the ticket with encrypted connections (HTTPS) and secure cookie settings, and they make it expire after a set amount of time.
To Be More Precise: They Aren't Rivals
It's easy to think of cookies and sessions as two completely separate, competing technologies. But in fact, most sessions work with the help of cookies. The most common way to store the session ticket in your browser and show it to the server every time is, you guessed it, a cookie. You can also attach the ticket to the web address (the URL), but it's easy for others to see, so it's rarely used.
What happens if you turn cookies off completely in your browser settings? No matter how many session tickets the server sends, your browser can't save them. On sites that rely on cookies, you get logged out the moment you move to another page.
To be more precise, these days many systems also use token-based authentication, where the server doesn't keep a ledger at all. It helps connect mobile apps and multiple servers more flexibly. Still, at the root of how a web browser remembers things, cookies and sessions working together are still at the core.
Common misconceptions
Cookies are a kind of malicious virus that hacks and breaks your computer.
A cookie is just plain text data. It can't run programs or spread viruses by itself. That said, cookies can be used to track your browsing history and search habits, and if a cookie holding your login information gets stolen, someone else could get into your account, so it pays to be careful.
Where you meet it
You add clothes to your cart at an online store without logging in. A few days later you come back and the cart is still full. That's thanks to cookies.
You log in to your bank's website, then don't click anything for a while. A message pops up: "You have been logged out automatically for your security." That's the session expiration feature at work.
In one sentence
A cookie is a memo note left on your own computer, and a session is a safe ledger kept by the server. They team up to keep you logged in and keep track of your state on a website.