They’re stored in memory as part of the conn. At the start of a request they’re retrieved from the session store configured for Plug.Session and at the end of the request it’s stored back into that storage. The default session store for plug/phoenix is cookie based, so the values are persisted in an cookie on the http response and send back to the server by the browser. There are also server side session stores available.