What you need to know
localStorage persists across sessions and is useful for preferences such as a theme. It is accessible to scripts running on the page, can be unavailable in some environments, and should not be treated like a secure database.
How to apply it
Store only small values that are safe to keep on that device, handle JSON parsing errors, and provide a default when storage is empty or blocked. Sync important preferences only through a deliberate account flow.
Common mistake to avoid
Never store passwords, session secrets, or sensitive personal data in localStorage. XSS can expose values to scripts running on the page.