What is JWT?
JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting claims between two parties, commonly used for authentication and authorization in web applications and APIs.
How Does JWT Work?
A JWT consists of three Base64-encoded parts separated by dots: a header (specifying the signing algorithm), a payload (containing the claims or data), and a signature (ensuring the token has not been tampered with). When a user logs in, the server generates a JWT signed with a secret key or private key and returns it to the client. The client includes this token in subsequent requests, typically in the Authorization header, allowing the server to verify the user's identity without querying a database.
JWTs are stateless by design — all the information needed to validate the token is contained within the token itself. This makes them ideal for distributed systems and microservices where maintaining server-side session state is impractical. However, JWTs cannot be easily revoked once issued (since there is no server-side session to invalidate), so they are typically given short expiration times and paired with refresh tokens. JWTs are also used for information exchange between services, API authorization, and single sign-on (SSO) implementations.