JWT

A JWT is a compact, digitally signed token that securely carries a user's identity and related claims between two parties. After a user logs in, a server can create a JWT that encodes who the user is and what they are allowed to do, then hand it to the user's browser. On every subsequent request, the browser sends the token back, and the server can trust its contents because the signature proves the token has not been tampered with and was issued by the server itself. This lets a system recognize a returning user without having to look them up in a database on every request.

Mechanically, a JWT is made of three parts joined by dots: a header, a payload, and a signature. The header describes the type of token and the signing algorithm. The payload holds the claims, small pieces of information such as the user's identifier, their role, and an expiration time. The signature is created by cryptographically signing the header and payload with a secret key that only the server knows. When the token comes back, the server recomputes the signature and compares it; if they match, the token is genuine and untouched. It is important to understand that the payload is encoded, not encrypted, so anyone can read its contents, which means a JWT should never carry secrets. Its protection is integrity, proving the data was not altered, not confidentiality.

The abbreviation stands for JSON Web Token, referring to the JSON format used for its contents. The standard was finalized in 2015, giving the industry a common, compact way to encode signed claims that could travel easily in HTTP headers, URLs, or cookies.

For a business, JWTs matter because they enable scalable, stateless authentication. Because the server can verify a token using only its signing key, it does not need to store session data centrally or query a database to check who the user is on each request. This makes JWTs a natural fit for systems spread across many servers or built as microservices, where a shared session store would be a bottleneck. A token issued by one service can be trusted by another, as long as they share the verification key, which simplifies building distributed applications and APIs that need to recognize users consistently.

The nuances and common mistakes are important to security. Putting sensitive data in the payload is a classic error, since it can be read by anyone holding the token. Failing to set a reasonable expiration leaves a stolen token useful for too long, and because a standard JWT cannot be easily revoked before it expires, teams often keep lifetimes short and pair them with refresh tokens. Accepting tokens without properly validating the signature, or allowing insecure signing algorithms, opens serious holes. JWTs relate closely to authentication and authorization, whose results they carry, to OAuth, which frequently uses them as its token format, and to browser storage mechanisms like local storage where they are sometimes kept, a choice that carries its own security tradeoffs. Handled carefully, a JWT is a lightweight, portable proof of identity.