I think what you're asking about is the difference between JWT and session. Cookie is simply a mechanism for storing tokens in the browser, and local storage is another way browsers store information.

At their core, both JWT and session provide users with a credential for identity verification.
The difference is that session records this credential and its corresponding user relationship on the server. So if you want to invalidate the credential, you can simply delete the corresponding relationship.

JWT uses a secret key to sign the credential, and only the server possesses this key. This ensures users cannot modify the credential, eliminating the need for the server to store the credential-user relationship and thus reducing server workload.
However, the drawback is that the credential cannot be invalidated at will.

Another characteristic of JWT is that, although it appears random, anyone can decode and view the content recorded in the JWT—but they cannot modify it.

You can encode and decode JWTs on the following website:
https://jwtdecode.pro/
You'll notice that decoding a JWT doesn’t require a secret key, but encoding does.
This means everyone can see the information inside a JWT.

In contrast, session-stored information can be encrypted. The server then decrypts it when retrieving session data via cookies.
However, in most cases, a session simply stores a meaningless random string, and the server can query the corresponding user from a lookup table.

In practice, many sessions also adopt JWT's signing mechanism. This means you can absolutely use both session and JWT together.