JWT
JWT (JSON Web Token) is a compact, self-contained token that securely conveys claims as a JSON object, widely used for stateless authentication and information exchange.
Purpose
It passes authentication information between stateless services, eliminating server-side session storage.
Mechanism
It has three parts—Header (algorithm).Payload (claims).Signature—all Base64URL-encoded. The signature uses HMAC or RSA, and verifying it guarantees integrity. Claims include iss (issuer), exp (expiry), and sub (subject). The token is not encrypted; keep sensitive data out of the payload.
Use cases
- Stateless API authentication
- OAuth 2.0 tokens
- SSO cross-domain identity transfer
- Service-to-service authentication
Examples
- Input
header.payload.signatureOutputRead the payload after verifying the signatureBase64URL plus signature
Common errors
- Placing sensitive data in the payload (it is only Base64, not encryption)
- Keep only non-sensitive claims in the payload
Related terms
OAuth
OAuth 2.0 is an authorization framework that lets third-party applications access a user's resources with the user's consent, without sharing passwords, by using tokens. GLOSSARY
Cookie
A cookie is a key-value pair set by the server and stored by the browser, sent automatically with same-origin requests for session and state management. GLOSSARY
HMAC
HMAC (Hash-based Message Authentication Code) is a message authentication code combining a hash function with a secret key, providing integrity and authenticity. GLOSSARY
Bearer Token
A Bearer token is a token type that works purely by possession: it is sent in the Authorization: Bearer <token> header, so whoever holds it can use it, with no additional credentials. GLOSSARY