JWT · JSON Web Token
/ jot /
A JWT is a compact, self-contained token that says who you are and is signed so the server can trust it. Think of it like a tamper-proof wristband at a festival: it has your details printed on it, and a seal that proves staff actually issued it. Show the band and you're waved through — nobody has to look you up in a list.
That's the clever part. A traditional login means the server keeps a session in its own memory and checks it on every request. A JWT instead carries the facts inside the token itself, and the server just verifies the signature. No database lookup, which is why JWTs are popular for keeping you logged in across many servers.
A JWT comes in three dot-separated parts — header.payload.signature — and the first two are just Base64, not encryption. So never put secrets in a JWT; anyone holding it can read the payload. The signature stops them from changing it, not from seeing it.
Authorization: Bearer eyJhbGci.eyJzdWIi.SflKxw // header . payload . signature
A JWT sent on a request: three parts, signed so the server can verify it without a lookup.
Pronounced 'jot'. Because a JWT can't be un-issued before it expires, keep expiry times short — once it's out there, it's valid until the clock runs out.