You&#x27;re not incorrect, but that&#x27;s not really the whole story either. If the thing the cookie is remembering is an authentication token, then the difference is more technologies involved than anything else. They are both &quot;something you have&quot;, and they both provide proof of authentication to a site.