Tech Definitions
What Is a JWT?
JWT is the most common way modern web apps prove "this request is from an already-logged-in user" without checking a database on every request.
What Is a JWT?
A JWT (JSON Web Token) is a compact, digitally signed token used to represent claims -- typically "who this user is" and what they're allowed to do -- between two parties. It consists of three parts, separated by dots: a header (describing the signing algorithm), a payload (the actual claims, like user ID and expiry), and a signature (which proves the token hasn't been tampered with).
How JWT Authentication Typically Works
- User logs in with a username and password
- Server verifies the credentials and issues a signed JWT
- Client stores the JWT and sends it in the Authorization header on subsequent requests
- Server verifies the token's signature (and expiry) without needing to query a database or session store
- If valid, the server trusts the claims inside the token and processes the request
Important Security Notes
- A JWT's payload is only encoded (Base64), not encrypted -- never put secrets inside one, since anyone can read the payload
- The signature proves the token wasn't tampered with, not that its contents are private
- Once issued, a JWT is valid until it expires -- there's no built-in way to "log it out" server-side without extra infrastructure (a blocklist, short expiry + refresh tokens, etc.)
- Always verify the signature server-side on every request -- never trust an unverified token's claims
Frequently Asked Questions
No, by default it's only encoded and signed, not encrypted -- anyone can decode and read the payload. The signature only guarantees it hasn't been altered. If you need to hide the contents, you'd use a JWE (JSON Web Encryption) variant instead of a standard JWT.
Not natively -- that's a well-known tradeoff of JWTs being self-contained/stateless. Common workarounds are short expiry times paired with refresh tokens, or maintaining a server-side blocklist of revoked token IDs, which reintroduces some server-side state.
No -- OAuth is an authorization framework/protocol; JWT is just a token format. OAuth flows commonly issue JWTs as access tokens, but you can use JWTs for authentication without OAuth at all, and OAuth doesn't require JWTs specifically.