← Back to Blog
jwtauthsecuritybrowserencryptionJune 27, 2026 · 3 min read
StandardSimply explained

Plain Text and Vault: Why Your localStorage Lies Open and Your Login Doesn't – Simply Explained

PLAIN TEXT · LOCAL STORAGE VAULT · APP-BOUND · TPM
Editorial illustration, split: on the left an openly readable token card under 'LOCAL STORAGE / PLAIN TEXT'; on the right a heavy safe marked 'HttpOnly', 'APP-BOUND' and 'VAULT', below it a 'TPM' chip with a key set into it and the label 'DEVICE-BOUND'.Editorial illustration, split: on the left an openly readable token card under 'LOCAL STORAGE / PLAIN TEXT'; on the right a heavy safe marked 'HttpOnly', 'APP-BOUND' and 'VAULT', below it a 'TPM' chip with a key set into it and the label 'DEVICE-BOUND'.

Something odd happened in the last part. Looking into the browser drawer, the most important logins were missing. Google, Microsoft, simply not there. Not because they have no ID card, but because they don’t lay it out in the open drawer. They lock it in a safe.

That’s the whole difference. Some services, smaller apps especially, lay their ID card out in the open drawer. In technical jargon that drawer is called localStorage. Whoever pulls it open reads the card. The big services put theirs in a safe instead, one the browser built for itself. Whoever just finds the safe and carries it off holds a locked box, nothing more.

You can see this yourself: at ChatGPT the ID card lies out in the open drawer. At Google there’s nothing usable there, the login sits in the safe.

My little tool from the last part reads exactly this open drawer. Technically it does the same thing as a piece of malware, except it stays home and sends nothing anywhere. Until recently, by the way, the safe was easy to open too. Its lock was tied only to the question “are you this computer’s user?”, and malware you catch runs as exactly that user. Since 2024 the safe asks something else: “are you really the genuine browser?”

Top privileges don’t help

Now you might think: then I’ll just give myself the highest privileges on the machine, and I’ll get at everything. But it doesn’t help. The safe doesn’t ask how powerful you are. It asks whether you’re the genuine browser. Highest privileges don’t answer that. So the real burglars don’t crack the lock at all, they disguise themselves as the browser.

A safe the browser can open on its own, and it has to, otherwise you’d type a password on every start, can in the end also be opened by malware that passes itself off as the browser. The safe is a high fence, not a magic wall. But a high fence keeps most out. It even catches harmless tools: a well-known program for downloading videos, which fetches cookies from the browser, hasn’t worked on Windows since.

The real protection

Building a better safe doesn’t solve the root problem. The root problem is that the card can be copied at all, and the copy works just like the original. No matter how good the safe is, once it’s out, the card works everywhere.

The real solution makes the copy worthless. It binds the card to your device. For that the browser stores a secret key in a small security chip in the computer, one it can’t be copied out of. Every few minutes the browser uses it to prove: I’m still the same device. If someone steals the copy and tries it on their machine, they’re missing this key, and the copy is dead. This method is called DBSC and was recently built into Chrome on Windows. The same principle exists a level up, in the app itself, where it’s called DPoP.

This shift makes the mass thefts from the last two parts come to nothing. Stolen cards by the hundred thousand are only valuable as long as they work everywhere.

What it comes down to

Where you keep the card, in the open drawer, in the safe, or in the security chip, was never the real question. The question is whether the card works in any stranger’s hand or only on your device. A better safe for a card that fits everywhere only postpones the problem. A card that fits only on your device takes the point out of stealing it.