title: Hashes or tokens for "remember me" cookies?
body: <p>When it comes to <em>remember me</em> cookies, there are 2 distinct approaches:</p>
  
  <p><strong>Hashes</strong><br>
  The <em>remember me</em> cookie stores a string that can identify the user (i.e. user ID) and a string that can prove that the identified user is the one it pretends to be - usually a hash based on the user password.</p>
  
  <p><strong>Tokens</strong><br>
  The <em>remember me</em> cookie stores a random (meaningless), yet unique string that corresponds with with a record in a <em>tokens</em> table, that stores a user ID.</p>
  
  <p>Which approach is more secure and what are its disadvantages?</p>